3.0 KiB
Privacy and security
Certificate, key and JWK material is parsed locally and kept only in page memory. The app makes no network request, does not consult a trust store, and has no telemetry, analytics, account or persistence. File input is size-checked before it is read; text/DER input is limited to 8 MiB, PEM input to 256 blocks, and JWKS input to 1,000 valid JWK objects.
Private or symmetric material is prominently warned about. Password use has a separate explicit opt-in; leaving the enabled field blank deliberately requests an empty PKCS #12 password. A supplied password can verify supported PKCS #12 MacData and decrypt modern PBES2 PKCS #8/SafeContents in page memory. The password and decrypted key/SafeContents bytes are not put in inspection reports or persistence, and transient plaintext buffers are overwritten after metadata extraction. Public certificates may remain in the result for path analysis. The operations workspace can generate an AES key and display cryptographic output so the user can copy it, but it does not store it. A compromised browser, extension, device, clipboard or screenshot can still expose sensitive material, so users should prefer public test material whenever possible and leave the page when finished.
Fingerprints and thumbprints identify exact bytes or canonical JWK members; they do not establish identity or trust. Explicit-input path analysis is not complete RFC 5280 validation, validity dates use the selected inspection time, and no live revocation check is performed. A verified PFX MacData authenticates the encoded AuthenticatedSafe under the supplied password; it does not establish certificate trust or validate every semantic use of a bag. PFX files without MacData are explicitly reported as unauthenticated. Rendered values are React text rather than imported HTML.
The fixed WebCrypto profiles are narrow interoperability tools, not a cryptographic protocol. RSA-OAEP is limited to short UTF-8 messages; AES-GCM authenticates the tool's JSON envelope; ECDSA signatures use the browser WebCrypto representation. Authentication/decryption failures return only an error. Algorithm availability, including Ed25519, depends on the current browser.
PBES2 AES-GCM authenticates its ciphertext. PBES2 AES-CBC does not provide integrity; a successful password, padding and PKCS #8 structure check cannot authenticate the encrypted container. Password text is converted to PBKDF2 bytes as UTF-8, which may not match every legacy producer's password convention. Encrypted PEM objects are inspected sequentially, and one shared 20,000,000-iteration PBKDF2 budget prevents a multi-object input from multiplying the per-object work limit.
PKCS #12 legacy PBE (including RC2/3DES), unsupported CMS content, non-X.509 certificate bags and excessive nesting are rejected instead of partially interpreted. CRL, secret and unknown bag values are inventoried by type/OID but deliberately not decoded or exported. The parser is a narrow local inspection implementation, not a general PKCS #12 writer or a replacement for hardware-backed key storage.