Security documentation

Security model and limitations

Keyvora is a local-first toolkit, not a security boundary or a replacement for independent verification.

Threat model

Tool inputs are processed in page memory and are not sent to a Keyvora application server, placed in URLs, analytics events, or application logs. A compromised device, malicious browser extension, injected third-party script, or copied output can still expose data outside this model.

Boundaries

• Password strength is an estimate, not a complete audit.
• JWT decoding does not verify a signature or issuer.
• Hashing and encoding do not provide encryption.
• Use an up-to-date browser and verify critical results independently.

Report a vulnerability

Please email security@keyvora.app with steps to reproduce. Do not include passwords, tokens, private keys, or other sensitive values in a report. See our privacy policy for data handling.