Zero-Telemetry Cryptographic & Anti-Tracking Verification Tools

Why Policy-Based Online Decoders Are an OPSEC Liability

During incident response and pre-signing verification, engineers routinely paste raw multisig transaction hexadecimal strings, unpublished wallet addresses, BIP-39 test vectors, or internal PDFs into third-party web utilities. Standard web decoders load external analytics beacons, advertising pixels, and unpinned CDN scripts while transmitting user inputs to backend APIs, creating permanent IP-to-address correlation logs and supply-chain hijacking surfaces exemplified by the December 2023 CDN drainer injection.

Every DT.gl verification sandbox is architected so you never have to trust our server configuration alone: network isolation is enforced by your own browser kernel via immutable HTTP response headers delivered on the document load.

Complete Sandbox Security & Capability Matrix

How to Audit Our Sandbox Headers in 30 Seconds

1. Open any of the five offline tools above (for example, the Calldata & Signature Auditor) and open browser Developer Tools (F12 or Cmd+Option+I).
2. Select the Network tab, refresh once, click the top HTML document request, and confirm Content-Security-Policy specifies connect-src 'none'; form-action 'none'; style-src 'self'; script-src 'self'.
3. Clear the Network request log (or switch your workstation Wi-Fi/Ethernet completely offline) and run any preset or custom verification payload: zero outbound packets are emitted and every computation succeeds deterministically offline.

Architectural Design of Zero-Dependency Cryptographic Islands

Most browser-based developer tools import sprawling npm dependency trees (`ethers`, `web3.js`, `pdf.js`, or UI component frameworks) totaling megabytes of minified code whose transitive maintainers change over time. High dependency depth is incompatible with high-assurance cryptographic verification: a single compromised minor release in a transitive formatting utility can hook `HTMLInputElement.prototype.value` or override clipboard buffers during transaction signing.

Every interactive module inside the DT.gl Verification Workbench (`src/islands/*.ts`) adheres to four strict software supply-chain rules:

• Zero External Runtime Dependencies: Core primitives including 24-round Keccak-f[1600] hashing, recursive-length prefix (RLP) decoding for EIP-7702 Type-0x04 envelopes, GF(256) finite-field polynomial evaluation and Lagrange interpolation for Shamir secret shares, combinatorial UTXO subset-sum partitioning for Boltzmann entropy, and binary JPEG/PNG chunk parsing are implemented directly in auditable TypeScript alongside native browser WebCrypto (crypto.subtle and crypto.getRandomValues).
• Strict Separation of Presentation and Logic (`style-src 'self'`): Tool modules never write to element.style or inject dynamic <style> tags. Allowing 'unsafe-inline' stylesheets weakens browser defenses against CSS attribute-selector exfiltration attacks (`input[value^="0x4a"]`). Instead, every state transition toggles deterministic semantic classes compiled into external immutable stylesheets.
• Volatile Memory Hygiene & Explicit Buffer Clearing: File sanitizers operate on ephemeral ArrayBuffer slices and revoke temporary Blob object URLs upon reset; statutory deletion notice generators build legal text strings strictly in volatile DOM state without writing to localStorage, IndexedDB, or cookies.
• Real-World Forensic Test Vectors Built In: Rather than requiring users to hunt for sample inputs, each auditor ships with one-click historical exploit and privacy test vectors (such as the February 2025 Bybit Safe operation=1 DELEGATECALL payload, omnichain chain_id=0 EIP-7702 sweeper tuples, and Trojan Source CVE-2021-42574 Bidi/Unicode Tag prompt injections) so security teams can validate organizational runbooks immediately.

Choosing the Right Verification Utility by Operational Workflow

Before co-signing a treasury multisig transaction or approving an unfamiliar token contract, load the raw hex data or Safe transaction parameters into the Calldata & EIP-7702 Signature Auditor on a separate device from your coordinator machine to confirm operation === 0 (standard CALL) and verify the independent safeTxHash digest on your hardware signer screen. Before consolidating Bitcoin UTXOs or importing multiple accounts into a browser wallet, model link probabilities and batch JSON-RPC exposure in the Wallet RPC & UTXO Exposure Lab. When publishing screenshots, PDFs, or integrating third-party Model Context Protocol (MCP) configurations into an IDE agent, pass files and JSON descriptors through the EXIF/PDF & Invisible Unicode Sanitizer to eliminate hidden author metadata and invisible instruction tags.

Published Tool Technical Specifications (6)

• Offline EVM Calldata, EIP-712 Safe Hash & EIP-7702 Risk Visualizer Verify raw EVM hex calldata, Safe multisig domainSeparator and safeTxHash digests, Permit2 allowances, and EIP-7702 SetCode tuples 100% offline.
• Mobile Telemetry, Data-Broker Risk Scorer & Statutory Opt-Out Generator Score your mobile RTB, cellular CPNI, and crypto-KYC physical exposure across 14 surveillance vectors and generate statutory DROP, CCPA, and GDPR erasure demands locally.
• Offline Seed Entropy, GF(256) Shamir & Multisig Quorum Lab Audit casino dice and coin entropy via Shannon and Chi-Square tests, split synthetic secrets over GF(256) Shamir polynomials, and simulate multisig faults offline.
• Wallet RPC Leak, UTXO Boltzmann Entropy & Address-Poisoning Auditor Simulate wallet JSON-RPC IP and JA4 batch correlation, compute Bitcoin UTXO Boltzmann partition entropy offline, and detect GPU vanity address poisoning.
• Zero-Telemetry Browser Fingerprint, TLS/ECH & URL Sanitizer Workbench Audit Canvas, WebGL, AudioContext, Sec-GPC, and WebRTC fingerprinting locally, strip 72 URL tracking parameters, and inspect stateless TLS 1.3 PQC and ECH negotiation.
• Zero-Upload Binary Metadata Stripper & Unicode MCP Injection Scanner Strip JPEG EXIF GPS, XMP, IPTC, C2PA, PNG ComfyUI/Stable Diffusion chunks, and PDF /Info locally, and scan MCP tool descriptions for invisible Unicode prompt injection.