# How PrivacyKit Works — Zero-Knowledge Client-Side Architecture

> Zero Server Logging. 100% Client-Side Execution. Verifiable Cryptography.

## AI Overview — Architectural Principle
PrivacyKit is designed on a zero-knowledge, client-side security architecture. All input evaluation, entropy scoring, string analysis, and cryptographic hashing execute locally within your web browser. No user credentials, plaintext passwords, or raw email addresses ever leave your device or reach our servers.

## 1. Cryptographic Execution Model
Traditional web utilities process user inputs by transmitting sensitive data over the network to cloud APIs. PrivacyKit fundamentally rejects this paradigm to eliminate network interception and server-side log exposure.

- **Web Cryptography API (`window.crypto.subtle`):** All cryptographic operations—including SHA-1, SHA-256, and random byte generation—leverage the W3C standard Web Cryptography API natively compiled inside modern browser engines for hardware-accelerated, zero-leak processing.
- **Web Workers CPU Isolation:** Resource-intensive string analysis and entropy search space computations are offloaded to dedicated background Web Workers. This guarantees isolated CPU execution, preventing main thread lag or DOM memory sniffing.
- **Mathematical k-Anonymity Protocol:** For our Email Breach Checker, PrivacyKit uses the k-Anonymity cryptographic model. Your browser hashes your email address locally, extracts only the first 5 hexadecimal characters (20 bits of the hash), and requests matching hash buckets from public databases. The server returns anonymous hash suffixes, and your browser matches the full hash in local memory. Our servers never see your email, full hash, or identity.

## 2. Step-by-Step Developer Verification Guide
In cybersecurity, trust requires verification:

1. Press `F12` (or `Ctrl + Shift + I` / `Cmd + Option + I`) to open **Browser Developer Tools**.
2. Click on the **Network** tab and filter by **Fetch/XHR**.
3. Navigate to the [Password Strength Checker](https://privacykit.tech/tools/password-checker).
4. Type any test password or passphrase into the input field.
5. **Observe the Network Log:** ZERO network requests are sent. All real-time entropy scoring and GPU crack estimates occur 100% locally.
6. For the [Email Breach Checker](https://privacykit.tech/tools/breach-checker), inspect the outgoing request: verify that only a 5-character hash prefix is sent, returning an anonymous bucket without transmitting your email.

## 3. Regulatory & Compliance Framework Alignment
- **NIST SP 800-63B:** Digital Identity Guidelines (Memorized Secret Authenticator validation, length > complexity, dictionary checks).
- **GDPR Article 25:** Data protection by design and default (Zero PII ingestion, zero data retention).
- **California CCPA / CPRA:** Consumer Privacy (No sale, collection, or cross-context tracking).
- **SOC 2 Type II Privacy:** Trust Services Criteria (Zero storage of customer credential data).

## 4. Frequently Asked Questions
- **Does PrivacyKit save or log any of my data?**
  No. PrivacyKit operates on a zero-knowledge model. All tool logic executes inside your browser via local JavaScript.
- **Can I use PrivacyKit tools completely offline?**
  Yes. Once the page is loaded, you can disconnect your Internet connection and continue using the Password Strength Checker offline.
- **What is k-Anonymity and why is it secure?**
  k-Anonymity is a mathematical privacy model. By sending only 5 characters of a SHA-1 hash, your query is cloaked among hundreds of matching records.