The master and pass-overlay inputs are now type=text with a CSS visual mask
(-webkit-text-security) instead of type=password, so the browser never treats
them as password fields — no autofill, no save prompt, no 'suggest strong
password'. Added autocomplete=off + autocapitalize/autocorrect off and
data-1p-ignore / data-lpignore / data-bwignore on the name + master + pass.
Matches the prefix-name default, the README, and the app's own help text (which
already says the default is six memorable words). Explicit modes are unaffected,
so existing catalogs round-trip unchanged.
main is a grid; its items default to min-width:auto, so the console card (pre /
no-wrap lines) refused to shrink and pushed the whole page wider than the phone
screen, clipping the About panel text. Set grid-template-columns: minmax(0,1fr)
so cards shrink to the viewport and the console scrolls internally instead.
- Make the privacy promise true: bundle the fonts (Poppins/Inter/JetBrains Mono
latin subsets + the text-security mask font) under helwasm/assets/fonts/ and
drop the Google Fonts + jsDelivr links. The page now makes zero external
requests once loaded — it talks to no third party.
- Say it plainly throughout the UI: a "Private by design" callout in the About
panel, the meta description, the quick-gen and console hints, and the footer —
nothing you type leaves the browser, no server, no account, no tracking.
- About panel (collapsible, closed by default with a pulsing "Help" badge)
explaining the tool; the `help` command now prints a full command reference
instead of "HELP" (benefits the CLI too).
- Live generation as you type; Store button; masked output that stays mono-width
(gen masks only the password column, never the header); command history with
Up/Down (persisted); console auto-scroll; Export fixed (uses `dump`); Import.
- Name field normalizes to its canonical parsed form on blur; quick-gen and Store
resolve the real entry name, so a leading prefix like `*P0 test1` is handled
correctly (new hel_parse / hel_parse_name wasm helpers).
- Parser: prefix-only forms now parse with defaults - `*P0 test1` ->
`*P0 test1 R 99 <today>`, `*P0 test1 R`, `*P0 test1 20R` - via new qpname/npname
rules mirroring qname/nname; the fully-qualified form is unchanged.
- Favicons + web app manifest + enso asset; pkg rebuilt.
Run the real hel core in the browser via WebAssembly, replacing the plain-JS
ooke.github.io/sk reimplementation so the web and the CLI share one generator.
- hel core: new storage module (native fs / wasm localStorage) backs
init/source/dump/correct; the pipe and pb branches are gated out of wasm;
the wasm editor is completed (EditorRef) and its password prompt no longer
blocks the single JS thread (synchronous hel_get_password instead of a
thread::sleep poll).
- helwasm: hel_load_script for bulk import, a panic hook in hel_init, dropped
the ok_add / web-sys leftovers; build.sh runs wasm-bindgen into a committed
pkg/ so GitHub Pages can serve the static dir with no CI.
- UI: rewritten index.html + style.css in the kaizenkodo.org style — responsive,
masked-but-copyable passwords with click-to-reveal, a quick-generate card plus
a full command console, localStorage persistence, and paste import/export.
Oleksandr Kozachuk
Oleksandr Kozachuk