spare key
  • open source
  • no cookies
  • no passwords
  • nothing stored

A spare key for every website you look after.

When one person builds and runs the website for a charity, a club or a friend, everything tends to sit in that person’s accounts and on their card. Spare Key maps what a site depends on, shows what would break if you were unavailable, and writes a handover document your client keeps.

Get started How it works 
$ lookup village-arts-trail.org
registrar  GoDaddy · renews in 43 days
dns        GoDaddy
website    Vercel
email      own mail server on AWS
sends as   Amazon SES, Brevo
cert       Let’s Encrypt · valid
! email runs on a server one person manages
! 6 services only the builder can reach

how it worksThree steps, about fifteen minutes per client

  1. 01

    Look up

    Type a domain. Spare Key reads public DNS, registration and certificate records to find the registrar, domain settings, website host, email provider and anything allowed to send mail as the domain.

  2. 02

    Record

    For each service, note whose name the account is in, who pays, and whether a second person can get in. Add what the lookup can’t see, such as a database or a mailing list.

  3. 03

    Hand over

    Download a plain-English Word document for the client, and an inventory file you both keep. Next year, open the file and check again.

what it flagsThe single points of failure that catch people out

  • Domains about to lapseRenewal dates, and whether auto-renew is on.
  • Accounts only you can reachNo second admin means no way in without you.
  • Bills on your cardThey stop when your payments do.
  • Email on a server one person runsThe most fragile part of most small setups.
  • Missing SPF and DMARCMail that lands in spam, or can be spoofed.
  • The wrong certificateVisitors see a security warning.

principlesThe map, not the keys

  • No passwords. It records where logins are kept, never the logins.
  • Nothing stored on a server. Only domain names are sent, to read public records. Your work stays in your browser and in files you save.
  • No cookies, no tracking. Just anonymous counts of which features are used, never what you type.
  • It won’t become a single point of failure. The documents work without this site, the file format is published, and the code is open source.
  • Accessible. Built and tested to WCAG 2.2 AA.
Get started