PumaReaper — what your survivors will need

This app is opinionated about a handful of things, all of them learned the hard way by other people.

• Record where a secret is, never the secret. Fields marked never write it here exist to hold a pointer — which password manager, which drawer, which sealed envelope. A binder holding live credentials gets printed, photocopied and left in a drawer for a decade.
• Beneficiary forms beat the will. On retirement accounts, pensions and life policies, whoever is named on the form takes the money regardless of what the will says. An ex-spouse left on a form from a previous decade is the single commonest expensive mistake here.
• Naming an executor is not asking them. The People section tracks whether each one has actually agreed. Finding out at the reading is a bad way for everyone to find out.
• A copy is not a will. Most jurisdictions need the signed original, and a will nobody can find is treated as a will that was destroyed on purpose. Every document asks where the original is.
• Wishes here are not legally binding. Who gets the piano, who raises the children — write it down by all means, but if it matters it belongs in the will, drafted by somebody qualified. This app is a map to your affairs, not an estate plan.
• Do not cancel the phone and email first. They are how the security codes arrive for everything else. The checklist says so, in the right place.
• Review after life events. A marriage, divorce, birth, death, move or new account can invalidate a document or strand an account. Each record carries its own reviewed date and goes stale on its own schedule.

Everything in the binder is encrypted with AES-256-GCM before it is written to this browser. The key is derived from your passphrase with PBKDF2-HMAC-SHA256, and it exists only in memory while the binder is open.

Two ways in, on purpose

A random data key encrypts the binder, and that key is then wrapped twice — once under your passphrase, once under the recovery code you were shown when you created it. Both open the same binder, independently.

That is the whole design. You seal the recovery code with your will or in a safe deposit box, and whoever needs to open this after you can — without ever learning the passphrase you still use on everything else.

What this does not protect against

• A weak passphrase. Encryption does not fix a guessable one. Length beats punctuation.
• Malware on this device. Anything reading your keystrokes reads the passphrase.
• The survivor packet. That export is deliberately plaintext — it is meant to be read. Treat the file and the printout as sensitive documents.

The binder locks itself after 15 minutes of no typing, and closing the tab locks it. There is no reset and no back door: forget both the passphrase and the recovery code and the data is gone, which is a property of real encryption rather than an oversight.

Everything stays in this browser. There is no account, no server and no network request at any point. The app is a single HTML file.

• Export writes an encrypted .pumapack — the sealed binder exactly as stored, openable with the same passphrase or recovery code. ⌘S / Ctrl+S does the same.
• Import takes that file back. It is a restore: it replaces the binder in this browser and opens with whatever passphrase was in force when the backup was made.
• Survivor packet produces the readable document — Markdown, print or PDF. It is not encrypted, and fields marked never write it here are stripped from it.

Clear all local data

Right-click the theme button for the accent picker; right-click a binder tab for its own menu.