Security

WoolKey is built on well-established cryptographic foundations with no custom crypto.

Web Crypto API

All randomness comes exclusively from crypto.getRandomValues(), the browser's cryptographically secure pseudorandom number generator (CSPRNG). Math.random() is never used. If the Web Crypto API is unavailable, generation is blocked — there is no insecure fallback.

WoolKey also mixes optional user-generated timing/interaction entropy (mouse, touch, pointer, and keyboard timing) into generated random bytes as defense-in-depth. Web Crypto remains the primary entropy source.

Rejection sampling (no modulo bias)

When selecting characters or words, WoolKey uses rejection sampling to ensure every item in the pool has exactly equal probability. A naive modulo operation introduces bias when the pool size does not evenly divide the random integer range; WoolKey avoids this entirely.

Fisher–Yates shuffle

After guaranteeing at least one character from each enabled character class, the result array is shuffled using the Fisher–Yates algorithm, implemented with crypto.getRandomValues(). This ensures no positional bias.

Entropy model

Entropy estimates are calculated as:

• Password: length × log₂(pool size)
• Passphrase: words × log₂(word list size)

The word list contains 1,144 words. A 4-word passphrase provides roughly 40 bits of entropy; a 6-word passphrase provides roughly 61 bits; an 8-word passphrase provides roughly 81 bits.

Strength labels correspond to entropy ranges:

• Weak — below 40 bits
• Fair — 40–59 bits
• Strong — 60–79 bits
• Very strong — 80–99 bits
• Excellent — 100+ bits

Content Security Policy

WoolKey's Apache configuration sets a strict CSP that includes connect-src 'none'. This prevents the browser from making any outbound network requests from JavaScript — even if malicious code were somehow injected, it could not exfiltrate data.

No server-side processing on the website

When you use the WoolKey website, Apache serves only static files. Generation happens entirely in the browser and the server never sees your passwords.

WoolKey additionally offers an opt-in HTTP API for scripts and AI agents, where generation necessarily happens on the server. That endpoint is separate: it is never used by this website, requires an API key, and stores nothing — no database, no log of generated values. The connect-src 'none' policy above means the pages you are reading cannot call it even if they wanted to.

Offline support

After the first visit, WoolKey's service worker caches all static assets. The application runs fully offline. Only static files are cached — generated passwords are never stored.

HTTPS requirement

WoolKey requires HTTPS. HTTP requests are redirected automatically via .htaccess. The Web Crypto API is available only in secure contexts (HTTPS or localhost).