純本地 AES-GCM 加密離線密碼保險箱 | Pure Local AES-GCM Encrypted Offline Password Vault
離線守密 ‧ 存在你手 (Safe Offline · Yours Alone)
Live Demo 立即體驗 | English | 繁體中文
在第三方數據洩露事件頻發與雲端資安風險日益嚴峻的時代，Safe Offline 貫徹「原生隱私 (Privacy-by-Design)」與「零信任 (Zero-Trust)」的數據管治原則。本系統採純前端解耦架構，完全無伺服器 (Serverless)、無後端、零上雲傳輸。你的密碼資料僅存於本地瀏覽器中，由你完全掌握。
- 🔒 零知識架構 (Zero-Knowledge Architecture)：數據於本地採 AES-GCM-256 原生加密，主密碼（Master Password）從不寫入任何 Storage 或遠端伺服器。
- 🛡️ 企業級嚴格 CSP 網絡隔離 (Strict CSP Isolation)：
- 徹底封鎖所有外部網絡連線 (
connect-src 'none')，杜絕任何潛在數據外洩。 - 移除所有內聯腳本與樣式（零
'unsafe-inline'），完全消除 XSS 攻擊面。 - 禁用 iframe 嵌入 (
frame-ancestors 'none')，有效防範點擊劫持 (Clickjacking)。
- 徹底封鎖所有外部網絡連線 (
- 🔑 OWASP 2023 抗暴破標準：PBKDF2 金鑰衍生提升至 600,000 次疊代，大幅增加 GPU 離線暴力破解成本。
- 🎲 密碼學拒絕取樣 (Rejection Sampling)：強密碼生成演算法採用拒絕取樣機制，完全消除取模偏差 (Modulo Bias)，達致 100% 均等真隨機。
- 📱 PWA 漸進式 Web 應用：支援 iOS / Android 安裝至手機主畫面，**完全斷網（飛航模式）**下亦可暢順開啟與解密。
- ♿ 無障礙設計與體驗優化 (WCAG & Usability)：完整支援鍵盤快捷操作（Enter 鍵解鎖）、解鎖視覺狀態反饋，並補齊 ARIA 標籤。
- 數據主權與數據最小化 (Data Sovereignty & Minimization)： 本系統遵循 GDPR Art. 25 (Privacy by Design and by Default) 原則。本應用程式不使用 Cookie、不進行追蹤統計（No Analytics）、亦不設任何遠端日誌（No Remote Logging）。使用者擁有數據的 100% 完全控制權與處分權。
- 責任歸屬與金鑰管理 (Accountability & Key Management)： 本系統為零知識（Zero-Knowledge）架構，無任何後端或重置機制。使用者必須自行承擔保管主密碼（Master Password）與定期備份 JSON 加密檔之責任。若主密碼遺失，任何第三方（包括開發者）均無法解密或復原數據。
- 免責聲明 (Disclaimer of Warranty)： 本專案採 MIT 開源授權 發布，軟體按「現狀 (As-Is)」提供，不含任何形式（明示或暗示）的擔保。開發者不對因使用本軟體所衍生之數據遺失、設備損壞或商業損失承擔任何法律責任。
In an era of increasing third-party data breaches and cloud security vulnerabilities, Safe Offline enforces strict Privacy-by-Design and Zero-Trust Governance principles. Built as a decoupled client-side web application, it features zero backend dependencies, zero cloud transmission, and zero data retention.
- 🔒 Zero-Knowledge Architecture: All credentials are encrypted locally via native AES-GCM-256. The Master Password is never written to disk or sent to any server.
- 🛡️ Financial-Grade Strict CSP:
- Total network isolation via Content Security Policy (
connect-src 'none'). - No inline scripts or styles (Zero
'unsafe-inline'), eliminating XSS attack vectors. - Anti-Clickjacking enforcement (
frame-ancestors 'none').
- Total network isolation via Content Security Policy (
- 🔑 OWASP 2023 Standard: Key derivation powered by PBKDF2 with 600,000 iterations, exponentially raising GPU brute-force costs.
- 🎲 Cryptographic Rejection Sampling: Password generation uses rejection sampling to eliminate modulo bias for true uniform randomness.
- 📱 PWA Support: Fully installable on iOS and Android. Works 100% in Airplane Mode.
- ♿ Accessibility & UX: Keyboard shortcuts (Enter key unlock), unlock visual state feedback, and complete ARIA accessibility tag support.
- Data Sovereignty & Privacy-by-Design: This application fully aligns with GDPR Art. 25 (Privacy by Design & Default). It uses no cookies, performs zero telemetry/analytics, and maintains zero server logs. Users retain 100% data sovereignty and control.
- Accountability & Zero-Knowledge Protocol: Due to the strict Zero-Knowledge architecture, there is no password recovery or backdoor mechanism. Users bear sole responsibility for safeguarding their Master Password and maintaining offline JSON backups. If the Master Password is lost, data recovery is cryptographically impossible.
- Disclaimer of Liability: This software is provided "AS IS", without warranty of any kind, express or implied under the MIT License. In no event shall the authors or copyright holders be liable for any claim, damages, or other liability arising from the use of this software.
Distributed under the MIT License. See LICENSE for more information.