// panoptikon — operational toolkit

KIT

Sometimes you can't boot the distro.

Borrowed laptop. Work machine. A country where booting from a USB draws attention. These tools exist for those gaps. They run entirely in your browser and send nothing to us — with one labeled exception: the IP check contacts an external service, which is disclosed on that tool. Use them, close the tab, clear your history. The browser holds no memory of what you did here. The machine does.

// these tools do not replace the distro. they cover the gaps when the distro is unreachable. get panoptikon →

// what these tools cannot protect you from

  • keyloggers or screen-capture software on the machine
  • malicious browser extensions with access to page content
  • network monitoring or TLS inspection by your ISP or employer
  • browser history, autofill, session restore, and tab recovery
  • corporate or state proxy logs that record every site visited

// shared and public machines are a last resort. the distro is always safer.

strip remove metadata from images hash verify file integrity phrase generate a strong passphrase cipher encrypt and decrypt text check audit your network exposure

// strip — image metadata removal

Strip

Every photo taken on a phone or camera carries hidden data — GPS coordinates, device model, serial number, timestamps, software version. This data has exposed journalists, identified activists, and pinpointed whistleblowers. Strip it before you share anything. Note: the output is always PNG — the visual content (faces, landmarks, distinctive backgrounds) is still present in the image and remains identifiable.

// file never leaves your machine. processed entirely in-browser using canvas api. heic files are not supported — convert first. animated gifs lose all frames and output as a static png.

drop image here

jpg  ·  png  ·  webp  ·  gif (static output only)

// hash — file integrity verification

Hash

Before you run any file you downloaded — ISO images, executables, documents from unknown sources — verify its hash. A single changed byte produces a completely different hash. If it doesn't match, don't trust it. The expected hash must come from a trusted channel separate from the download itself — if both the file and the hash come from the same compromised source, verification proves nothing.

// file never leaves your machine. hashed using browser's built-in subtlecrypto api. files over ~500mb load entirely into ram — large files may crash or hang the tab.

drop any file here

any format  ·  ~500mb max recommended

// expected hash — optional. paste to compare.

// phrase — passphrase generator

Phrase

A strong passphrase is your last line of defence for encrypted disks, password vaults, and secure communications. This generator uses your browser's cryptographically secure random number generator — nothing is sent anywhere. Generate several candidates, then choose one that is genuinely memorable to you. Writing it down and storing it separately is better than choosing a weak one you can recall from memory.

// uses crypto.getRandomValues with rejection sampling — no modulo bias. entirely local. minimum 5 words (~50 bits of entropy).

// words
// separator

// ~56 bits of entropy  ·  700 word list  ·  6 words

// cipher — text encryption

Cipher

Encrypt a message with a passphrase. The output is a base64 string — send it through any channel, post it publicly, store it anywhere. Without the passphrase it is noise. The length of the ciphertext reveals the approximate length of the original message — plan accordingly. Both parties must share the passphrase through a separate, trusted channel before using this. The phrase tool above can generate one.

// aes-256-gcm  ·  pbkdf2-sha256 (600,000 iterations, owasp minimum)  ·  entirely in-browser. note: pbkdf2 is deliberately slow — encryption takes a few seconds.

// message to encrypt

// passphrase

// check — network exposure audit

Check

See what the network sees when you connect. Check your public IP address, look for signs of Tor routing, and test for WebRTC leaks — a common vulnerability that can expose your real IP even when using a VPN or proxy. Tor detection is a heuristic based on the organisation name returned by the IP lookup — it is not authoritative. Use check.torproject.org for a definitive check.

// ip check contacts ipapi.co — your ip is visible to that service. webrtc test contacts stun.l.google.com to trigger candidate discovery — this is also an external call. both are clearly labeled.

The grid is always listening.

Give it static.