Security model
PangolinMatrix is an encoding system, not a password vault. It does not store your real passwords or your directive.
Your directive is shown once after verification and successful login, then removed from the session after confirmation.
The directive is a memorized rule, not a high-entropy master secret. The main security boundary is separation: keep your matrix away from your encoded password notes.
Browser-only helper
The encode/decode helper works from the matrix already loaded in your page. Typed password text is transformed locally in JavaScript and is not sent to our server.
You can also use the matrix manually without the helper.