← Back
AiWerkz

Prompt Manager V2 — Security & Overview

What is AiWerkz

AiWerkz is a personal prompt manager built for people who work with AI tools daily. It gives you a single, organised place to store, categorise, and instantly copy prompts — cutting the time spent hunting through notes, chat history, or scattered documents.

Prompts are synced to the server so they are available on any device you log into. Everything is encrypted before it leaves your browser, so the server holds only ciphertext it cannot read.

Security Model

AiWerkz uses a zero-knowledge encryption model called CSEDS (Client-Side Encrypted Data Sync). Your password never leaves your device. All encryption and decryption happens entirely in your browser.

Key Derivation
Argon2id
64 MB memory · 3 iterations · runs in-browser via WASM
Encryption
AES-256-GCM
Unique IV per save · authenticated encryption
Auth Key
Derived, not your password
First 32 bytes of Argon2id output — server never sees your password
Encryption Key
Non-extractable CryptoKey
Last 32 bytes of Argon2id output — lives in session memory only

What the Server Sees

Server knows
  • Your username
  • A derived auth key (not your password)
  • Your Argon2id salt
  • An encrypted blob (opaque ciphertext)
  • The timestamp of your last save
Server cannot know
  • Your password
  • Your encryption key
  • The contents of any prompt
  • Category names or structure
  • Anything inside the blob

Sync & Sessions

When you log in, your encrypted blob is pulled from the server and decrypted locally. Changes are encrypted and pushed on every save (with a short debounce). A local IndexedDB cache means the app loads fast even if the server is slow.

Sessions are single-device. If you log in on a second device, your first session is invalidated and you will be logged out automatically. This prevents silent data divergence across devices.

Credential Escrow

On successful login, your username and password are saved to a separate IndexedDB store on that device. This is the "Forgot credentials?" recovery feature — it only works on a device you have previously logged into, and the data never leaves that device.

The escrow stores your password in plaintext in the browser's IndexedDB. It is protected by browser origin isolation, but anyone with physical access to an unlocked, logged-in device could read it. Use device lock screens.

Browser Requirements

All modern browsers on desktop and mobile support these. No extensions, plugins, or native apps required.