Security model
PangolinMatrix is an encoding system, not a password vault. It does not store your real passwords or encoded password notes.
Registered accounts store the directive so the helper can encode and decode consistently without asking you to remember it each time.
The directive is a movement rule, not a high-entropy master secret. The main security boundary is separation: keep your matrix away from your encoded password notes.
Browser-only helper
The encode/decode helper works from the matrix already loaded in your page. Typed password text is transformed locally in JavaScript and is not sent to our server.
You can also use the matrix manually without the helper.