Offline ready
V 0.1.0

The key stays with the person you trust.

Create short-lived, signed approvals for a Guardian-protected PC. Everything happens on this device; no account, cloud, or network is required.

Private by construction

The encrypted controller bundle is opened only while signing. The decrypted key and passphrase are never saved.

STEP 1

Controller identity

Load the encrypted bundle your family already uses, or create one once and back it up carefully.

USE AN EXISTING IDENTITY

Open encrypted bundle

Choose the private .guardian-controller.json file. Loading it does not decrypt the signing key.

CREATE ONCE

New controller identity

There is no reset button. Store the passphrase separately from both encrypted bundle backups.
STEP 2

Guardian device

Import the public device identity exported by the enrolled Windows PC. It contains no private key or password.

PUBLIC FILE

Import device identity

This public identity may be remembered on this phone. It cannot sign an approval by itself.
STEP 3

Sign an approval

An approval works once, on one Guardian PC, for one exact action, during the short period you choose.

Two things are needed first

Load the encrypted controller bundle and select an enrolled Guardian device.

ControllerNot loaded
Guardian deviceNot selected

TRUST BOUNDARY

What this app protects

Guardian Controller is intentionally small, offline, and explicit. Its job is authorization—not surveillance.

Kept on this device

  • The encrypted controller bundle you explicitly open.
  • Public Guardian device identities you choose to remember.
  • The approval currently displayed for sharing.

Never stored

  • Your controller passphrase.
  • A decrypted private signing key.
  • Guardian or Windows administrator passwords.

Never contacted

No Guardian server exists in this app. A strict content-security policy blocks network requests, analytics, advertising, and remote code.

Recovery truth

If every encrypted controller-bundle backup or its passphrase is lost while a PC remains in managed mode, this app cannot manufacture a replacement approval. Test your backups before enrollment.

Guardian Controllerv 0.1.0Protocol schema 1 · ECDSA P-256 · PBKDF2-SHA256