check it yourself
You shouldn’t have to take our word for it
Any site that asks how your website is set up should make you cautious. Here is exactly what Spare Key sends, where it goes, and how to check it with the tools already in your browser.
There is no Spare Key server that receives what you type. The site is plain files.
Only to public lookup services, to read records that are already public.
Not passwords, PINs, card numbers or recovery codes. Ever.
Where a domain name goes when you look it up
Your browser sends the domain name, and nothing else, to these services. Spare Key never connects to the website itself.
| Address | Who | Why |
|---|---|---|
cloudflare-dns.com | Cloudflare public DNS | reads the DNS records: where the website and email point |
data.iana.org | IANA | the official list of which registry looks after each domain ending |
api.certspotter.com | Cert Spotter (SSLMate) | reads the public log of security certificates |
(the registry for the ending) | Domain registries such as Nominet, Verisign and PIR | the public registration record: registrar and renewal date |
The 37 registry addresses on the list
pubapi.registry.google · rdap.blog.fury.ca · rdap.ca.fury.ca · rdap.cctld.au · rdap.centralnic.com · rdap.dns.pl · rdap.eco.fury.ca · rdap.fi · rdap.gmoregistry.net · rdap.identitydigital.services · rdap.isnic.is · rdap.nic.biz · rdap.nic.club · rdap.nic.design · rdap.nic.earth · rdap.nic.fr · rdap.nic.garden · rdap.nic.health · rdap.nic.law · rdap.nic.ly · rdap.nic.one · rdap.nic.scot · rdap.nic.tv · rdap.nic.yoga · rdap.nixiregistry.in · rdap.nominet.uk · rdap.norid.no · rdap.publicinterestregistry.org · rdap.radix.host · rdap.registry.bar · rdap.registry.cloud · rdap.registry.love · rdap.registryservices.music · rdap.sidn.nl · rdap.tonicregistry.to · rdap.verisign.com · tld-rdap.verisign.com
Everything else, the people, services, notes and risks, stays in your browser on this device until you download it. Your draft is kept in this browser’s storage so a reload doesn’t lose it, and “Clear” removes it.
Four ways to check
Watch the traffic
Open your browser’s developer tools (on a Mac, Option + Command + I) and choose Network. Look up a domain and fill in the rest. Every request is listed, and you’ll see only the addresses above.
Read the lock on the door
In the same Network tab, click the page itself and find the
content-security-policyheader. Itsconnect-srcline is the complete list of addresses this page may contact. Your browser, not us, blocks everything else.Unplug it
Once the page has loaded, turn off your Wi-Fi. You can still fill everything in and download the handover. Only new lookups need a connection.
Read the code, or run your own copy
All of it is on GitHub. To run it on your own computer, clone it, run
node scripts/serve.mjsand openhttp://localhost:4173.
If someone stole everything you typed
They would learn which registrar, host and email provider you use, which anyone can already find in public records, and who pays for each. They would not get a password, because Spare Key never asks for one. That is deliberate: the safest data is data that isn’t worth stealing.
How to recognise the real Spare Key
- The address is https://sparekey.dev.
- A request from a website owner opens a link starting https://sparekey.dev/#start.
- It never asks for a password, a code sent to your phone, or payment.
The code is open source, so anyone can copy it and we can’t stop that. A copy that asks for a password is not us.
Found a fake, or a security problem?
Email hello@jharbourne.com, or report it privately through GitHub’s security reporting. Our security.txt has the details. In the UK you can also forward suspicious emails to report@phishing.gov.uk and report a suspicious website to the National Cyber Security Centre.
Who made this
Spare Key is made by Jonathan Harbourne, a UX and accessibility designer in Essex who founded the LGBT History Project. It started after one of his own websites went down and he realised everything depended on him. Get in touch at hello@jharbourne.com.