# PrivacyKit — Technical Documentation & Architecture Specification

> PrivacyKit (https://privacykit.tech/) is a zero-knowledge, client-side cybersecurity utility suite built by SystemRootMedia. It delivers instant security assessments—including password entropy evaluation, IP geolocation intelligence, and data breach checks—without capturing, transmitting, or storing user inputs or Personally Identifiable Information (PII).

---

## 1. Core Tools Overview

### 1.1 Password Strength Checker & Real-Time Entropy Calculator
- **URL**: `https://privacykit.tech/tools/password-checker`
- **Function**: Calculates information entropy (measured in bits), estimates brute-force crack times across modern hardware configurations (e.g., 8x NVIDIA RTX 4090 GPU clusters), identifies weak patterns, and provides actionable recommendations.
- **Execution Model**: Runs 100% client-side using JavaScript and the `window.crypto` Web Cryptography API. Passwords entered by the user never leave the browser runtime memory and are discarded upon tab closure.
- **Entropy Formula**: E = L * log2(N), where L is password length and N is the character set pool size (numbers=10, lowercase=26, alphanumeric=62, full ASCII=95, Diceware=7776).

### 1.2 IP Address & Geolocation Intelligence Lookup
- **URL**: `https://privacykit.tech/tools/ip-lookup`
- **Function**: Detects the visitor's public IPv4/IPv6 address or queries any user-specified IP address to retrieve geographic location (Country, Region, City), Autonomous System Number (ASN), Internet Service Provider (ISP), network hostname, timezone, and proxy/VPN risk signals.
- **Privacy Model**: IP queries execute via direct client-side fetch requests to privacy-preserving geolocation endpoints. Search history is stored strictly in local browser memory (sessionStorage) and is never logged on PrivacyKit servers.

### 1.3 Email Breach Checker (Zero-Knowledge k-Anonymity Protocol)
- **URL**: `https://privacykit.tech/tools/breach-checker`
- **Function**: Allows users to check whether an email address or username has surfaced in known dark-web data breaches.
- **Mathematical Privacy Protocol (k-Anonymity)**:
  1. The user enters an email address into the input field.
  2. The browser computes the SHA-1 hash of the normalized email address locally using `window.crypto.subtle.digest('SHA-1', data)`.
  3. Only the **first 5 hexadecimal characters** (20 bits) of the hash prefix are transmitted to the breach database API (e.g., `https://api.pwnedpasswords.com/range/{prefix}`).
  4. The remote API returns a candidate list of all matching 5-character hash suffixes.
  5. The client browser locally compares the remaining 35 characters of the full hash against the returned candidate list.
  6. **Guarantee**: The full email address and full hash are NEVER transmitted over the network, mathematically guaranteeing zero-knowledge anonymity (k >= 500).

---

## 2. Technical Architecture & Compliance Standards

- **Cryptographic Execution**: All hashing and entropy calculations utilize standard browser W3C Web Cryptography APIs (`window.crypto.subtle`).
- **NIST SP 800-63B Guidelines**: Password recommendations enforce modern National Institute of Standards and Technology standards: minimum 15+ character passphrases, elimination of arbitrary complexity rules, and resistance to rule-based dictionary masks.
- **OWASP ASVS Compliance**: Architected in accordance with OWASP Application Security Verification Standards for zero client-side data leakage, strict Content Security Policy (CSP), and HTTP Strict Transport Security (HSTS).
- **Static Edge Delivery**: Served as pure static assets via Netlify's Global CDN with global Edge Security functions (`security-monitor.js`) for rate limiting and WAF defense.

---

## 3. Site Navigation & URL Structure

### Tools & Utilities
- `https://privacykit.tech/tools/password-checker` — Password Strength & Entropy Analyzer
- `https://privacykit.tech/tools/ip-lookup` — IP Address & Geolocation Lookup
- `https://privacykit.tech/tools/breach-checker` — Email Data Breach Scanner (k-Anonymity)

### Educational Pillars & Guides
- `https://privacykit.tech/blog` — Privacy & Cybersecurity Blog Index
- `https://privacykit.tech/blog/how-strong-is-your-password` — Password Security & Crack Time Standards
- `https://privacykit.tech/blog/what-does-your-ip-address-reveal` — IP Privacy & Geolocation Guide
- `https://privacykit.tech/blog/what-is-a-data-breach` — Data Breach Defense & Account Security Guide
- `https://privacykit.tech/blog/what-is-two-factor-authentication` — 2FA & Multi-Factor Security Guide
- `https://privacykit.tech/blog/how-to-create-a-strong-password` — Step-by-Step Password Creation & Passphrase Guide

### System & Architecture Pages
- `https://privacykit.tech/how-it-works` — Technical Architecture & Client-Side Execution Explainer
- `https://privacykit.tech/about` — Mission, Technology Stack, and Developer Transparency
- `https://privacykit.tech/contact` — Contact Information & Feedback
- `https://privacykit.tech/privacy` — Zero Data Collection & Privacy Policy
- `https://privacykit.tech/terms` — Terms of Use

---

## 4. Frequently Asked Questions (FAQ)

### Q: Does PrivacyKit collect or store any user input?
A: No. PrivacyKit operates under a strict zero-knowledge architecture. All computation takes place in the user's browser runtime. No databases, session cookies, input loggers, or telemetry trackers exist.

### Q: Can PrivacyKit tools be used offline?
A: Yes. Once loaded, tools like the Password Strength Checker execute fully offline because all JavaScript utilities are loaded locally into browser memory.

### Q: Who maintains PrivacyKit?
A: PrivacyKit is independently designed, developed, and maintained by SystemRootMedia as an open privacy-first initiative.