Tutorial 2 of 7
Secrets stay on your device
Beginner 6 min
How Keysmith separates public material from secret test values, what runs in your browser, when it asks before using the server and what is saved in projects.
A crypto lab is only useful if you can trust it with test material. Keysmith therefore treats every input as one of two kinds.
Public material and secret test values
Public material — certificates, public keys, TLS profiles, passkey responses — is sent to the usefulweb.site tool API when you run an item. The API processes it for that request and does not store it.
Secret test values sit in a dashed box called Secret test values on the item: HMAC keys, test passwords, password candidates, secrets to split, recipe inputs and tokens, emoji notes, file passphrases. They are
- kept only in the open browser tab,
- not autosaved, not written to project files, share links or Google Drive,
- not sent to the server without asking.
What runs on this device
Every action shows a chip:
| Chip | Meaning |
|---|---|
| Runs on this device | Web Crypto in your browser; nothing leaves it |
| Uses the usefulweb.site tool API | The inputs of this run go to the tool API |
| Device or server, depending on the options | Local for some settings, server for others |
Local work includes SHA-1/SHA-2 hashes and HMACs (Checksum or signature check), PBKDF2 and HKDF (Password hashing (KDF)), random passwords (Password policy → Generate samples), Shamir splitting and recovery tests, and AES-256-GCM file encryption. Keysmith's local code produces the same results as the site tools: the encryption uses the File Encryption Studio's UWFE format, the shares use the format of the Shamir Secret Sharing tool.
The breach check is special: Keysmith hashes each candidate with SHA-1 locally and sends only the first 5 of 40 hex characters to the Private Breach Checker (k-anonymity). The match happens in your browser.
The confirmation dialog
Some functions only exist on the server: scrypt and Argon2id, the Password Entropy Race, Crypto Kitchen and CyberChef-lite recipes, the emoji cipher. When such a run needs a secret test value, Keysmith asks Send to the usefulweb.site server? and names what will be sent:
- Send this time — for this item, until you close the tab.
- Always allow in this project — sets the project policy to Server allowed.
- Cancel — nothing is sent.
The project policy
The chip in the toolbar shows the policy and opens Project settings:
- Ask first (recommended) — the dialog above.
- Local only: never send secrets; such runs are blocked — runs that would send a secret stop with a message; for KDFs, scrypt and Argon2id are skipped and the PBKDF2/HKDF results are still computed locally.
- Allow for this project (demo data only).
Saving demo values on purpose
Templates contain published demo values (RFC examples, GitHub's webhook documentation) so you can try everything at once. Those items have Save secret test values in the project (only for demo or throw-away values) ticked. Before saving a file or creating a share link, Keysmith lists every item that keeps secrets and asks again.
Edit → Forget secrets and outputs of this tab wipes every unsaved secret, file and generated output at once, including the undo history.
What Google Drive receives
Save to Drive (when you are signed in) stores exactly what a project file contains: the inventory, the run history with findings and metrics, and secrets only for items that keep them. Derived keys, generated passwords, shares and decrypted files are never part of a project.
Ready to try it?