v0.2.12 research preview

v0.2.12

This research preview adopts the owner-approved Radix Gray interface appearance shared by VINASIG websites.

Both light and dark mode use neutral canvas, panels, fields, text and headings. Strong field outlines remain distinguishable from their adjacent surfaces. Progress and range indicators use derived VINASIG blues with a contrasting depleted track. Original identity artwork, fonts and wordlist bytes are preserved.

System appearance, shared manual theme and language preferences, local secret generation, animation settings and the interrupted-tab countdown retain their existing behavior. No runtime dependency, network request, secret storage or new telemetry is added. Source hashes are updated for the explicitly reviewed CSS adoption.

Release requires successful Linux and Windows CI, cross-OS byte equality and exact-tag build attestations. Browser checks cover both locales, appearance modes, animation, timers, clipboard, script failures and privacy restrictions. These are automated technical observations and remain separate from independent security review or participant evidence.

v0.2.11 research preview

v0.2.11

This research preview makes result animation follow the selected settings and preserves interrupted tab use.

Password scramble frames use the selected groups after character exclusions. Passphrase frames use lowercase letters from the selected verified vocabulary, preserving separators and internal underscores/hyphens. The decorative animation does not change secret sampling, wordlists or generation-space accounting.

Switching tabs or applications pauses the remaining visible-time countdown and removes plaintext and animation from the DOM. Returning before the five-minute inactivity deadline restores the same volatile result, countdown, show/hide choice and manual pause state, without new secret draws or animation. Hidden time still counts toward inactivity expiry. Actual page departure clears the session. First entry generates once after integrity verification. Narrow masked WebKit output wraps within its field.

The undeployed v0.2.9 and v0.2.10 tags exposed Firefox navigation waits in no-JavaScript test contexts. These fixtures now verify actual HTTP 200 navigation, the exact new document and complete readiness through a separate document navigation primitive. The shared preference oracle remains unchanged, and script-enabled visual navigation retains font/image readiness checks. Failed traces are preserved; assertions, limits, coverage and the no-retry policy remain intact.

Release requires successful Linux/Windows CI, cross-OS byte equality and exact-tag build attestations. Automated validation and deployed observations remain distinct from independent security review and participant evidence.

v0.2.8 research preview

v0.2.8

This research preview adopts VINASIG's shared theme and language preferences under WEB-011. Appearance defaults to the operating system, with light as the unavailable-API fallback. The default-language entrypoint follows supported browser languages. Explicit theme/language choices use two finite Secure parent-domain cookies shared with the other VINASIG websites. There is no preference server, tracking identifier or secret storage.

Appearance changes update existing tabs without navigation. Language changes from another site navigate an untouched page while preserving tabs with trusted form, result, paste or drop interaction until their next load. Native locale links and offline pages remain available; blocked cookies use bounded local or volatile fallback. Original shared chrome/artwork, cryptographic sampling, wordlists and secret lifecycle are unchanged.

Source/CSP checks cover both embedded scripts. Three-engine actual-artifact tests exercise distinct HTTPS subdomains, system changes, manual overrides, protected input, legacy migration, malformed/duplicate cookies and denied storage. Local and deployed evidence remain separate. The release still requires exact-version notes, successful Linux/Windows CI, byte-identical packages and build attestations.

The CSP regression now submits a form to its own browsing context and waits for the actual script, connection and form policy events instead of assuming they arrive within 100 ms. The same blocked-behavior, navigation and response-header assertions remain required. Foreign-frame blocking retains its separate adversarial fixture. v0.2.7 did not pass the Windows publication gate and was not released; its tag is preserved unchanged.

v0.2.6 research preview

v0.2.6

This research preview delivers the nine output-interaction corrections in the acceptance review: full-width password wrapping, a visible 1.2-second scramble, adjacent Generate/Show/Hide/Copy actions, length-matched masking, exact native selected-text Copy, bold countdown seconds, contextual low-bit guidance, aligned translated metrics and concrete Vietnamese instructions. Cryptographic sampling, vocabulary, shared chrome and original font/brand assets are unchanged.

Both v0.2.4 and v0.2.5 were held by failed CI and published no release. The latter established that changing the awaited driver lifecycle event from load to DOMContentLoaded was insufficient. Script-enabled HTTP app navigation now uses one browser location.assign action, then requires the requested URL in a fresh document, readyState complete, a successful main-document HTTP response, ready fonts and decoded images. The preceding document receives a marker that must disappear, so an old already-loaded document cannot satisfy readiness. This avoids reliance on the unresolved page.goto completion path without catching a timeout, accepting a failed page, retrying navigation or weakening interaction assertions. Offline file, JavaScript-disabled and foreign-ancestor fixtures retain their original direct navigation for their distinct capability boundaries. The precise intermittent driver cause remains undetermined.

A new adversarial browser case verifies rejection of a 404 document and an undecodable image, followed by a successful real app navigation. The full matrix now has 135 cases across Chromium, Firefox and WebKit with zero retries. Failed executions retain JSON results and diagnostic traces through CI. Every tagged release still requires successful Ubuntu/Windows builds, byte-identical deterministic artifacts and exact-tag build provenance. Deployment and affected live checks are recorded separately after their execution; historical tags and failures are retained.

v0.2.3 research preview

v0.2.3

This research preview corrects the owner's reported interface defects and adopts the common VINASIG interface acceptance gate. Publication requires verification of this exact tagged revision, matching Ubuntu/Windows artifacts and build-origin attestations.

Resulting behavior

• Choice cards use one visible selected surface with separated vocabulary options, vertically centered icons, native radio keyboard behavior and forced-colors focus/selection.
• Word-count, length, group and exclusion errors appear beside the affected field with linked accessibility descriptions. Both count controls use the same bounds.
• Desktop separator choices share one row. Target labels align with their bit buttons.
• Short results use a compact output; maximum-length phrases expand to fit. Hide, Copy and Clear sit 12 px below it. Eye/EyeOff icons follow the volatile visibility choice.
• Pause, Resume, selection and copying use one explicit state. Resume works with the pointer remaining on its button; hover alone does not freeze rotation. A pending clipboard write temporarily disables Resume.
• Countdown has a visible depleted track in both themes. Character options stay open, and the success message states that a new result was generated.
• Original shared header/footer artwork, theme action, CSS, fonts, vocabulary bytes and cryptographic sampling are preserved.

Evidence

The acceptance review maps every reported defect to a regression and opened synthetic images. The canonical standard adds WEB-010 for both web profiles, including deliberate negative fixtures; it is imported through a reviewed immutable bundle with a rollback record. Structural diagnostics, behavior tests and visual observations have separate scopes. This release does not claim independent review, participant usability evidence or that a checklist guarantees an interface without defects.

v0.2.2 research preview

v0.2.2

This research preview introduces automatic generation and consistent VINASIG chrome. Publication is gated on verification of this exact tagged revision. Earlier v0.2.0 and v0.2.1 release attempts did not publish: the first exposed a pause-control failure, and the second exposed a geometry fixture that confused focused-input scrolling with layout movement. Their signed tags remain unchanged. The pause label now preserves its click target, and geometry checks use document coordinates with recorded scroll offsets and unchanged one-pixel bounds.

Behavior

• Generate after verified startup, relevant settings changes, a visible 60-second countdown and Generate now.
• Show results by default and preserve show/hide until reload.
• Animate visible results with a 480 ms character scramble, with cancellation, copy guards and reduced-motion support.
• Keep even a 20-word longest-token animation inside the output viewport, without moving Generate now when the final text appears.
• Freeze the countdown on result hover or selection. Copy pauses until resumed. Clear stops rotation. Automatic ticks never extend the five-minute inactivity deadline.
• Synchronize text inputs and sliders, clamp shared upper limits and clear stale results for incomplete input.
• Use shared Sun/Moon theme icons, localized accessible names, appearance-only persistence and consistent footer navigation.
• Give the output a separate surface, place Generate now with a 24 px gap and show results before settings on narrow screens.
• Default to hyphen-separated passphrases, preserving source spellings and verifying unique token decoding.
• Replace repeated vocabulary warnings in the form with concise usage guidance, while retaining original technical evidence and data identities.

Validation scope

Uniform-selection, adversarial, Unicode, lifecycle, clipboard, privacy, CSP and artifact checks remain required. The browser suite covers the automatic interaction model in both languages and themes on Chromium, Firefox and WebKit. Publication requires the exact tagged revision to pass paired CI, byte-equal packaging and build-origin attestations. These automated checks do not imply an independent review or participant study.

v0.1.0 research preview

v0.1.0

This is a research preview of a static local password/passphrase generator. No independent security review, participant validation or production assurance is implied.

Passwords use Web Crypto and unbiased arbitrary-size rejection sampling. Optional composition requirements use exact completion counting and unranking over valid strings. Passphrases use the original EFF long list and unchanged, explicitly experimental Vietnamese Passphrase profiles. UI numbers describe generation space, not account security or a cracking-time promise.

Two languages, light/dark/forced-color controls and paired standalone HTML files share readable bundled code. There are no runtime packages, tracking, fetched lists, storage or service worker. Copy is explicit, masked secrets are absent from the DOM and lifecycle events clear page state. JavaScript, browser and clipboard erasure cannot be guaranteed.

The source, offline and complete static-site ZIPs have deterministic entry ordering and timestamps. Source pins, build records, automated adversarial and browser checks, license scopes and release verification instructions are included. The site artifact preserves the exact checked bytes and response-header configuration for Pages Direct Upload. Release attestations and environment records describe the actual published build when publication is authorized and successful. Local validation and prepared workflows must not be confused with executed CI.

Static response headers include host-only HSTS, CSP with exact embedded-code hashes, framing restrictions, no-referrer, MIME checking, origin isolation and restricted permissions. The canonical Cloudflare hostname has scoped rules preserving artifact bytes and suppressing injected analytics and network-reporting headers. These delivery controls do not authenticate a compromised publisher or guarantee browser/clipboard erasure.

Verified publication on 7 October 2026

The live service is available in Vietnamese and English. Its corresponding source is the signed tag at commit adff43695456fe8189dfe54ea5a9582ebd22d686.

• The tag workflow succeeded on Ubuntu 24.04 and Windows 2025 VS2026, followed by cross-environment comparison, provenance and publication. Each environment passed 22 unit tests and 57 browser tests. The two environment JSON assets record the actual runner images and toolchain; this does not imply a hermetic future build.
• All seven public assets were downloaded and verified with GitHub CLI against the exact release workflow identity, GitHub OIDC issuer, tag, source/signer digest and GitHub-hosted runner policy. Their attested subjects and transparency-log records were inspected. The three ZIPs, checksum file and build record also matched the earlier main CI artifacts on both operating systems. A fresh Windows build from the downloaded source ZIP reproduced all five deterministic assets byte for byte. The Python ZIP reader passed 151 source, 19 offline and 22 site entries.
• The verified public site ZIP was uploaded to the existing Pages production project. All 21 publicly served files matched its bytes. Actual responses matched all nine declared security/cache header values, including host-only Strict-Transport-Security: max-age=31536000; NEL and Report-To were absent on every checked URL. HTTP redirected to HTTPS.
• The live deployment passed 36 browser cases across Chromium, Firefox and WebKit, both locales, actual light/dark themes and widths 320, 390 and 1440. Each exercised password generation and all three phrase profiles, masked/revealed/cleared state, generation-space counts and list membership. The tests observed no application request after the initial document, no cookies/storage, no page errors or horizontal overflow. These are automated browser observations, not participant or physical-device evidence.

During deployment verification, unchanged files such as robots, sitemap and licenses retained older cached headers despite successful content revalidation. The Pages origin and a cache miss returned the new header correctly. Purging only the password.vinasig.io.vn hostname resolved this, after which all URL checks passed. When response headers change, purge this hostname's zone cache and verify normal public URLs again. Do not substitute cache-busting test URLs for the actual delivery check.

Private vulnerability reporting, dependency alerts/security updates, secret scanning and push protection are enabled for the public repository. Search Console successfully processed the sitemap and discovered two pages; live inspections allowed crawling/indexing, and both indexing requests were accepted. Actual Google indexing is not asserted. The VINASIG tool catalog and both organization-profile languages include this project.

Pages uses Direct Upload. Source pushes run CI; future website updates require uploading a verified site ZIP. No persistent deployment API credential or Cloudflare GitHub App installation was created. Hosting providers can observe the initial HTTPS request metadata; generated secrets are not part of application requests.