sparekey beta

A spare key for every website you look after.

When one person builds and runs the website for a charity, a club or a friend, everything tends to sit in that person’s accounts and on their card. Spare Key maps what a site depends on, finds the single points of failure, and writes a continuity plan your client keeps. It’s routine good practice, like a spare key for the office.

I build websites I own a website

Builders map a client’s setup and write the continuity plan. Owners send a request to the person who looks after their website.

$ lookup village-arts-trail.org
registrar  GoDaddy · renews in 43 days
dns        GoDaddy
website    Vercel
email      own mail server on AWS
sends as   Amazon SES, Brevo
cert       Let’s Encrypt · valid
! email runs on a server one person manages
! 6 services only the builder can reach

how it worksThree steps, about fifteen minutes per client

  1. 01

    Look up

    Type a domain. Spare Key reads public DNS, registration and certificate records to find the registrar, domain settings, website host, email provider and anything allowed to send mail as the domain.

  2. 02

    Record

    For each service, note whose name the account is in, who pays, and whether a second person can get in. Add what the lookup can’t see, such as a database or a mailing list.

  3. 03

    Hand over

    Download a plain-English Word document for the client, and an inventory file you both keep. Next year, open the file and check again.

for website ownersDoes one person look after your website?

Ask them for a spare key. Fill in a few details, and we write the email for you. They do the technical part, and you get a plain-English continuity plan to keep.

Ask for a continuity plan

what it flagsThe single points of failure that catch people out

  • Domains about to lapseRenewal dates, and whether auto-renew is on.
  • Accounts only you can reachNo second admin means no way in without you.
  • Bills on your cardThey stop when your payments do.
  • Email on a server one person runsThe most fragile part of most small setups.
  • Missing SPF and DMARCMail that lands in spam, or can be spoofed.
  • Old addresses left to lapseAnyone can buy them and use your old name. Domain policy
  • Open sign-up formsUsed to publish adverts on trusted websites.
  • Expired certificatesVisitors see a security warning.

principlesThe map, not the keys

  • No passwords. It records where logins are kept, never the logins.
  • Nothing stored on a server. Only domain names are sent, to read public records. Your work stays in your browser and in files you save.
  • No cookies, no tracking. Just anonymous counts of which features are used, never what you type.
  • It won’t become a single point of failure. The documents work without this site, the file format is published, and the code is open source.
  • Accessible. Built and tested to WCAG 2.2 AA.
Start a continuity plan

Rather fill it in yourself? Download the Word and Excel templates.