An encrypted keyboard overlay for any web page — the browser sibling of the
Secure IME Android keyboard. Committed ciphertext keeps the
v1|alg|nonce|ct|tag envelope format.
The switch lives in the toolbar and stays in sync with the keypad: in Encrypt mode keystrokes are buffered by the extension and only the sealed ciphertext reaches the page.
With capture on, keystrokes — including an external keyboard's — are buffered in the extension and shown in the overlay: the page never sees them. The same switch sits in the overlay's toolbar as ⌨ Capture. Password fields keep working normally.
The paper's proof-of-concept encrypts with a single-session key that this extension generates and keeps locally. Share the key with the person you are writing to (a different channel is safest); their KryptBoard — or any implementation of the paper's Algorithm 2 — can then read your messages. The key never leaves the browser and is never written to disk.
Fingerprint: none yet
Default: key = HKDF-SHA256(passphrase, salt = nonce, info = "KryptBoard v1|CHACHA20-POLY1305|aad=…").
The work factor that was used is recorded inside the envelope's alg field, so the receiver always
derives the same key. Nothing here touches the network.
Useful when auditing how a site reacts to synthetic input. Auto uses
execCommand when the field is focused (keeps the site's undo stack) and falls back to the
native value setter plus an InputEvent otherwise.
Envelopes are interoperable with the Android crypto-lib: paste one here to recover the
plaintext, or take one to the phone.