Security Baseline & Model
Security is baked into the architecture: secrets never enter URLs, logs, analytics, or localStorage; network targets are strictly validated before connection.
Core Security Invariants
Guaranteed technical baselines
100% Local-First Execution
Secrets, passwords, JWTs, QR codes, file hashes and JSON are computed purely in local browser RAM and never sent to our servers.
SSRF Protection & Public IP Pinning
Network checkers restrict ports to default HTTP/HTTPS, resolve and pin public IPs before socket connections, and revalidate on every redirect.
Zero Private & Loopback Access
Private IPs, 127.0.0.1, link-local, cloud metadata endpoints (169.254.169.254) and mixed DNS targets are blocked prior to connection.
Uniform Envelope & Strict Rate Limits
All network diagnostic requests carry a traceable Request ID, enforce tight CORS, and apply uniform rate-limiting envelopes.
Important Limitations
Explicit operational boundaries
JWT Decoder parses structure only
The tool decodes and formats Header and Payload claims for inspection; it does not cryptographic-verify the backend signature.
Network signals are diagnostic heuristics
VPN, Proxy, DNS leak and header checks provide diagnostic insights with potential false positives or negatives.
Not an enterprise security audit substitute
SFranKey aids daily developer & security workflows but does not replace dedicated enterprise password vaults or professional penetration audits.
CSPRNG, Web Crypto API & WebAssembly
All randomness for TOTP and passwords derives from cryptographically secure `window.crypto.getRandomValues`. SHA/MD5 hashes compile via WebAssembly for blistering speed and absolute isolation.