Overview
KeyForge solves the tension between strong unique credentials and memorability by deriving output deterministically from user-held context. The tool runs locally and does not need an account or backend.
ChallengeCreate unique credentials without storing or transmitting a password vault.
SolutionDerive deterministic output from a private master key, account context, and rotation version.
ResultA reproducible local workflow with explicit character-policy feedback.
Derivation contract
Key stretchingPBKDF2 with SHA-256 and 600,000 iterations
DerivationHMAC-SHA-256 using account context and rotation version
Entropy sourceBrowser Web Crypto getRandomValues for generated master keys
BoundaryInputs and derived credentials remain inside the current browser session
Engineering decisions
- Browser-native cryptographic primitives keep the implementation small and auditable.
- Inputs stay in the current browser session rather than being transmitted to a service.
- The interface prioritizes clear controls and direct feedback over unnecessary workflow.
Security consideration
Derived credentials are only as strong as the master material and usage discipline behind them. The tool communicates that boundary rather than claiming to replace a password manager for every use case.
What this project demonstrates
- Applying browser-native cryptography to a clear user problem.
- Designing deterministic output with explicit rotation and account context.
- Keeping sensitive input out of network and storage paths.
- Communicating security boundaries instead of overstating guarantees.