Application architecture
The application is generated as static files. It contains no server API route, account service, key database, telemetry client, or application upload endpoint. RSA generation uses browser WebCrypto, and the format serializer is loaded in the client bundle.
Network boundary
Loading the website requires ordinary network requests for static assets. After those assets are available, Generate, Convert, Copy, Download, and Clear do not initiate application network requests. A future service-worker phase will address reliable precached offline installation.
Supported material
Phase 1 accepts only unencrypted RSA private keys in modern OpenSSH or PKCS#1 PEM containers, with a fixed input-size limit. Encrypted keys, PKCS#8, PuTTY PPK, Ed25519, ECDSA, certificates, and hardware-backed keys require different workflows.
Runtime memory
Key values remain in page memory while displayed. Clear removes interface references and wipes tracked byte arrays where possible, but JavaScript strings and browser-managed memory cannot be deterministically zeroized by application code.
Operational guidance
Use a trusted device and browser profile, close unrelated extensions, work on copies, verify fingerprints, protect downloaded files, and prefer established local command-line tooling when organizational policy forbids browser handling of private keys.
Reporting a vulnerability
A public security contact and responsible-disclosure process must be supplied before launch. Do not include private keys, passphrases, or other production credentials in a vulnerability report.