Privacy, Security Considerations, and Troubleshooting
Cryptology Monster includes browser-side cryptographic processing and a local data-clearing feature. This page describes the behavior supported by the supplied source code, important security limitations, and common troubleshooting steps.
Browser-Side Cryptography
Many Cryptology Monster operations use the browser's Web Crypto API.
These include:
- AES-GCM encryption
- PBKDF2 key derivation
- SHA hashing
- HMAC
- RSA key generation
- Ed25519 key generation
- Secure random number generation
Other functionality uses JavaScript libraries, including OpenPGP.js and QR-processing libraries.
Privacy Considerations
Cryptographic operations are implemented in client-side JavaScript in the supplied application.
However, this alone does not prove that the complete deployed website makes no network requests or retains no information.
The privacy properties of a deployed website also depend on its hosting infrastructure, loaded scripts, logging, and other application components.
Sensitive Information
Avoid exposing:
- Secret encryption keys
- Master seed phrases
- Passwords
- Private keys
- Confidential plaintext
- Authentication tokens
The application displays some values in ordinary input fields and result dialogs.
In particular, the Text Encryption password mode displays the entered password in its result dialog.
Purge Local Data
Cryptology Monster includes a function named purgeLocalData().
The function attempts to remove locally accessible browser information.
Actions Performed
| Data | Behavior |
|---|---|
| Cookies | Attempt to expire accessible cookies on / |
| localStorage | Clear |
| sessionStorage | Clear |
| Clipboard | Attempt to replace text with an empty string |
| Input fields | Clear values |
| Text areas | Clear values |
| Code elements | Clear displayed text |
| Selected paragraph elements | Clear displayed text |
| Tool selector | Reset to first tool |
Important Limitations
The purge function does not establish complete data erasure.
It does not explicitly:
- Clear IndexedDB databases
- Clear Cache Storage
- Unregister service workers
- Delete downloaded files
- Clear browser history
- Delete server-side logs
- Remove HTTP-only cookies
- Destroy every cryptographic object in memory
It may also preserve content inside interface elements not included in its selector.
The function shows a completion alert without independently verifying that every cleanup action succeeded.
Do not treat Purge Local Data as a secure memory-erasure mechanism.
Troubleshooting
Cryptographic Operations Fail
The Web Crypto API generally requires a secure context.
Check that the website is accessed through HTTPS and that your browser supports the requested algorithm.
RSA Generation Is Slow
RSA 3072-bit and 4096-bit keys may require additional time to generate.
Performance depends on the browser and device.
Ed25519 Generation Fails
Native Ed25519 support depends on the browser's Web Crypto implementation.
Try a compatible, up-to-date browser.
PGP Tools Fail to Load
PGP operations require OpenPGP.js.
Check whether browser security settings, network restrictions, or CDN problems prevent the library from loading.
PGP Decryption Fails
Verify that:
- The encrypted message is complete.
- The private key is correct.
- The private-key passphrase is correct.
- The message was encrypted for that key.
- The armored content has not been modified.
Text Decryption Fails
Common causes include:
- Incorrect password
- Incorrect
key.bin - Incorrect encryption mode
- Damaged
encrypted.bin - Incompatible file structure
File Decryption Fails
Use the File Crypto decryption interface for files generated through File Crypto.
The password-based Text Encryption and File Crypto tools use different PBKDF2 iteration counts.
Password-Based Encryption Appears Slow
PBKDF2 deliberately performs many iterations.
The Text Encryption tool uses 100,000 iterations.
File Crypto uses 200,000 iterations.
Deterministic password generation also uses 200,000 iterations.
Deterministic Password Is Different
Check that all inputs match exactly:
- Seed phrase
- Site tag
- Counter
- Password length
The implementation trims surrounding whitespace from the seed and site fields.
Changing any relevant input can change the output.
HMAC Verification Fails
Ensure that:
- The same message was used.
- The same secret was used.
- The correct hash algorithm was selected.
- The correct key format was selected.
- The signature representation is correct.
The Sign tool outputs both hexadecimal and Base64url signatures.
JWT Signature Is Valid but Token Is Expired
The JWT verifier checks supported HMAC signatures.
It does not validate the expiration claim.
Applications must independently validate required JWT claims.
JWT Verification Says Unsupported Algorithm
The implementation only supports HS256, HS384, and HS512.
Asymmetric JWT algorithms are not supported by the current verifier.
Base64 Encoding Fails
The implementation uses btoa() directly.
Non-Latin Unicode characters may require conversion to UTF-8 bytes before Base64 encoding.
Base32 Decoding Produces Unexpected Characters
The implementation does not use an explicit UTF-8 text conversion.
It also skips unrecognized Base32 characters, so malformed input may produce unexpected results.
QR Image Cannot Be Copied
Copying an image to the clipboard depends on the Clipboard API and browser support.
Use Download PNG instead.
QR Code Cannot Be Decoded
Try a clear image with:
- Sufficient resolution
- Good contrast
- Minimal distortion
- A fully visible QR code
The decoder may not recognize damaged or low-quality QR codes.
Known Implementation Limitations
| Area | Limitation |
|---|---|
| Random Passwords | Small selection bias from modulo mapping |
| Password Strength | Simple 4-point heuristic |
| Entropy | Observed character frequency, not cryptographic unpredictability |
| Text Encryption | Trims plaintext |
| Text Password Mode | Displays the entered password in its result window |
| Text Salt Input | Shown in UI but ignored by encryption logic |
| Text/File Interoperability | Different password-based PBKDF2 iteration counts |
| Base64 | Direct btoa()/atob() without UTF-8 conversion |
| Base32 | Byte-oriented character processing; decoder skips unsupported characters |
| JWT | HMAC verification only |
| JWT Claims | No expiration, issuer, or audience validation |
| String Comparison | Not constant-time |
| RSA/Ed25519 PEM | Private keys exported without passphrase encryption |
| Purge Data | Partial, best-effort browser cleanup |
Security Best Practices
Use Strong Passwords
Avoid short, predictable, reused passwords.
Protect Private Keys
Do not distribute private-key files.
Store secure backups when future access is required.
Confirm Cryptographic Formats
Use the correct tool for the output format.
Not all AES-GCM encrypted files or public-key formats are interchangeable.
Verify Public Keys
Confirm key fingerprints through an independent, trusted channel.
Treat Decoded Content as Untrusted
Decoded JWTs, Base64 text, and QR codes may contain malicious or misleading information.
Verify Before Deleting
Test encrypted files by decrypting them successfully before deleting their original copies.
Keep Software Updated
The security of browser cryptographic applications also depends on the browser and included software dependencies.
Reporting Issues
When reporting a Cryptology Monster problem, include:
- Tool name
- Browser and operating system
- Algorithm or mode selected
- Error message
- Steps to reproduce the issue
Never include real passwords, secret keys, private keys, unredacted tokens, or confidential plaintext in bug reports.
Final Reminder
Cryptology Monster provides useful cryptographic operations, but selecting a strong algorithm is only one part of secure data handling.
Correct key management, trusted software, safe storage, secure authentication, and responsible operational practices remain essential.
Updated 9 days ago