Open-source · Continuity · Privacy · No accounts
Spare Key
A free tool for anyone who looks after a website for somebody else. It maps what a site depends on, shows what would break if you were unavailable, and writes the handover document the client keeps.
Context
One person usually builds and runs the website for a charity, a club or a friend. The domain is registered in their name, the hosting is on their card, and the DNS sits in an account nobody else has ever opened. That arrangement works perfectly well right up until the moment it does not.
The problem
The risk is not technical. It is that none of it is written down anywhere, and the person who knows is the person who is unavailable. The organisation finds out what it depended on at exactly the moment it can no longer ask.
The approach
Type a domain. Spare Key reads public records to find the registrar, the DNS host, the website host, the email provider, anything permitted to send mail as the domain, and when the registration runs out. You add the part no lookup can see: whose name each account is in, who pays for it, and whether a second person can get in. It then marks the single points of failure and writes a plain-English Word document for the client to keep.
The lookups run in the browser against public services: Cloudflare’s DNS resolver, the registry’s own RDAP record found through IANA, and Certificate Transparency. There is no server, and the only thing that leaves the page is a domain name. A Content-Security-Policy blocks every other address, and a test keeps that policy in step with the lookup code, so the claim cannot quietly stop being true.
It is honest about what it cannot do. Spare Key never connects to the website itself, so it cannot tell you a wrong certificate is being served, only whether a current one exists. Where it does not recognise a provider it says “Unrecognised” rather than guessing.
The design decision that matters
The map, not the keys. Spare Key never asks for a password and has nowhere to put one. It records where the credentials are kept, which is the thing that is actually missing when somebody has to pick a website up.
The second rule follows from the first: it must not become the single point of failure it warns about. The Word document and the inventory file belong to the client and open without this site ever existing, the file format is documented so anyone can read it, and the code is MIT-licensed so anyone can run their own copy. There are no accounts and no cookies, and the working draft lives in your own browser until you save it.
Where it stands
Live at sparekey.dev and open source, currently in beta. Every push runs the unit tests and then Playwright and axe-core across every page, in light and dark, against WCAG 2.2 AA. Deployment is blocked unless both pass, so nothing reaches the site that has not cleared the standard it claims.