Security & architecture
How KeyStrong generates, and what it deliberately cannot do
Written for people who want to check the claims rather than take them. If something here is wrong or unclear, mail us and we'll correct the page.
Randomness
Every character, word index and byte comes from the system CSPRNG via
SecRandomCopyBytes. KeyStrong never uses arc4random seeded
from time, never uses a language-level Random(), and never derives output
from anything about your machine.
Selection uses rejection sampling, not modulo. A modulo reduction over an alphabet that doesn't divide 256 evenly biases the first characters of the set; rejection sampling discards out-of-range draws instead, so every character in your chosen alphabet is exactly equally likely.
How entropy is calculated
For generated output, entropy is the honest figure: log₂(alphabet size) × length, or log₂(7776) × words for passphrases. The number describes the generator rather than the string, which is why two passwords of the same length always report the same bits.
H = log₂(N) × L
N = size of the selected alphabet after exclusions · L = length. A 17-character password over the full 94-character printable set yields 111.4 bits; excluding ambiguous characters lowers N, and the readout drops accordingly.
For pasted input in the Analyse tab the estimate is deliberately pessimistic: observed character classes set an upper bound, then dictionary matches, keyboard runs, repeats and date patterns each subtract from it. The figure you see is the weakest reasonable reading of the input.
The word list
Passphrases draw from the EFF long word list - 7,776 words, each 3 to 9 characters, chosen to be common, unambiguous when typed and free of near-homophones. The list ships inside the app bundle. It is never fetched, and the list being public costs you nothing: security comes from the number of words you choose, not from secrecy about which list they came from.
Sandbox and entitlements
KeyStrong is sandboxed as required for the Mac App Store, and requests almost none:
| Entitlement | State | Why |
|---|---|---|
| network.client | absent | Nothing is ever sent |
| network.server | absent | Nothing listens |
| files.user-selected | read/write | Only when you export recovery codes or an SSH key yourself |
| Everything else | absent | No camera, microphone, contacts, location, Bluetooth or AppleEvents |
Memory, clipboard and history
Generated values live in memory for the life of the app process. Session history is an
in-memory array; it is not written to disk, not in the sandbox container, not in
UserDefaults, and not in the Keychain. Quitting the app ends it.
Copying puts the value on the general pasteboard, marked transient so macOS excludes it from Universal Clipboard handoff. A timer you control (15 s, 30 s, 60 s, or never) clears the pasteboard, and only if the value is still the one KeyStrong put there. We never overwrite something you copied afterwards.
Only preferences persist: length, character sets, appearance, clipboard timeout and shortcut. Never generated output.
What KeyStrong is not
It is not a password manager. It does not store, sync or fill your credentials, and it has no vault to breach. Put what it generates into a manager you trust (the Keychain, 1Password, Bitwarden) and KeyStrong's job is done.