v3.0.0 🦕 Iguanodon — the single-file era

v3.0.0 🦕 Iguanodon — the single-file era

IttyBitz is now one self-contained HTML file. The entire application — encrypt and decrypt, files and text, key files, password generation, QR and SeedQR export, BIP-39 detection — lives in a single page with no framework, no build step for users, no service worker, and zero dependencies. Open it online at ittybitz.app, or save it to disk and run it offline anywhere, forever.

Iguanodon was among the very first dinosaurs ever described — a fitting name for the first release of a new lineage.

Your data is unaffected. The cryptography did not change. The container format and key derivation are byte-for-byte identical to every prior release. Everything you have ever encrypted with IttyBitz still decrypts, in this file, in the app, and in the recovery tool. This is proven in CI against real ciphertexts from every release back to v1.0.

Why

Every security scare this project has fought — dependency advisories, the npm-audit treadmill, and above all the offline PWA that kept breaking — came from the machinery around the cryptography, never the cryptography itself. A single hand-written file removes that machinery entirely:

• No dependency tree → no dependency vulnerabilities. There is nothing to npm audit.
• No service worker → nothing to rot. Offline is no longer "install the PWA and hope the cache is warm." Offline is: you have the file.
• Auditable by anyone. The whole app is ~127 KB of readable HTML, CSS and JavaScript you can read top to bottom — not a minified bundle. Verifiability is the entire point of a "trust nothing" tool.
• Longevity. Save it next to your encrypted data. It will still open in a browser in twenty years, with no website, no project, and no author required.

Offline is now "save the file"

The installable PWA and its service worker are gone. To use IttyBitz offline:

1. Open ittybitz.app, then File → Save Page As… (⌘S / Ctrl+S) — choose "Web Page, HTML Only", or
2. Download ittybitz.html from the release.

Then open that file anywhere — disconnected, air-gapped, from a USB stick. The file has zero external subresources (the QR codes render to <canvas>, the logo is inline SVG, fonts are system fonts), so "Save Page As" produces one working file, and a Content-Security-Policy in the page makes a network request structurally impossible.

Two files, two trust levels

• ittybitz.html — the full two-way app. Encrypt and decrypt.
• ittybitz-recovery.html — the decrypt-only lifeboat. Deliberately half the code to audit, for the day you need to recover data and want the smallest possible thing to trust. See Recover/.

Verified in both directions

A single-file app is only trustworthy if it provably speaks the exact IttyBitz format. src/lib/crypto.ts and src/lib/bip39.ts are kept in the repository as the frozen reference implementation, and the crypto regression suite (npm run test:crypto) now gates ittybitz.html against them in both directions:

• it decrypts all 32 historical ciphertexts (v0 and v1, with and without key files);
• ciphertext it produces opens under the reference crypto.ts, and ciphertext crypto.ts produces opens under it — with and without key files;
• its BIP-39 validation and Standard SeedQR output match the spec vectors.

This is the guarantee a bundled copy of an app cannot give by inspection, and it runs on every push and pull request.

Architecture

site/index.html is assembled by npm run build (a plain concatenation — contributors only, never needed to use the app) from:

• scripts/build/head.html — the hand-written page (HTML + CSS)
• scripts/build/qrcode-lib.js — kazuhikoarase/qrcode-generator (MIT), vendored verbatim
• scripts/build/crypto-core.js — the DOM-free encrypt/decrypt core
• a BIP-39 core generated from src/lib/bip39.ts, so the wordlist can never drift
• scripts/build/app.js — the UI wiring

Removed

The Next.js / React application and everything that supported it: src/app, src/components, src/hooks, React, Tailwind CSS, Radix UI, lucide-react, qrcode.react, next.config.js, the TypeScript/PostCSS config, package-lock.json, the CSP-hashing and service-worker build scripts, public/sw.js, public/manifest.json, and the PWA icons. All runtime and build dependencies are gone — package.json now declares none.

Hosting

Unchanged for you: GitHub Pages still serves the site and ittybitz.app still resolves to it. The deploy workflow no longer builds anything — it publishes the site/ directory verbatim. No DNS changes, no Pages settings changes.

Upgrading

Nothing to do. Existing .ibitz files and encrypted text decrypt exactly as before. If you keep a saved copy of the app or the recovery tool for offline use, download the fresh v3.0.0 files from the release and re-verify their checksums.

---

Verify your download

3cc61ebde7b787e6bb1f5f823db68e79a34da152728a3c483150e060832a06cc  ittybitz.html
952da1fb5c9a4c89c7765e472042abbb4d127551c34b73af5e05e2cc1038b08d  ittybitz-recovery.html

shasum -a 256 <file> (macOS/Linux) or certutil -hashfile <file> SHA256 (Windows). The files are byte-identical to what ittybitz.app serves.