One browser per client.
Their credentials in a vault.
On a stick you take home.
For contractors and consultants holding several client tenants at once. Separate cookies, separate sessions, separate saved logins — and a master-password vault that does the copying so nothing sensitive ever reaches the page. Runs installed, or entirely from an encrypted USB drive that leaves nothing behind on a machine you were only visiting.
- No network
- No telemetry
- No administrator rights
- Encrypted at rest
- Open about its limits
Three clients. Three Microsoft tenants. One browser that keeps signing you into the wrong one.
Incognito windows forget everything nightly. Browser profiles work until you have to remember which one holds which login. Password managers keep the secrets and know nothing about which session they belong to. And the whole arrangement lives on one laptop — walk up to a client desk and none of it is with you.
WorkCtx treats a client as a context: one browser profile, its sites, its accounts and their secrets, opened together and closed together — and, if you want, carried on an encrypted drive that opens on any machine and leaves it as it found it.
How it works
A context is a client
Its own browser profile, colour, sites, accounts and apps.
- Genuinely separate cookies, logins and storage per client.
- Sign into the same tenant as three different people, at once.
- Sites open on start; Teams and the rest launch alongside.
- Per-monitor window placement, remembered per context.
A vault, not a password list
Argon2id and AES-256-GCM, calibrated on the machine it is made on.
- The copy happens in the agent. Plaintext never reaches the browser page.
- Clipboard clears itself, and only if nothing else has claimed it.
- TOTP codes with a live countdown.
- Two retentions, one password: names come back on one lease, secrets on a much shorter one.
Take it with you
The whole product on a USB stick, Windows and Linux from one drive.
- Each client’s profile is one encrypted archive on the drive.
- Runs from a fast working copy, sealed back when the context closes.
- A session stranded by a crash is recovered at the next start.
- Nothing readable left on a borrowed host.
The part with no obvious equivalent.
A browser profile on a stick is small random I/O on slow flash — thirty seconds to open a context, measured. So WorkCtx does not run from the drive. It unseals the client’s profile into a working copy on the host’s own disk, runs the browser there, and seals it back to the drive when the context closes.
What the drive holds, at every moment, is ciphertext. A stick lost on a train gives up nothing: not the sessions, not the client names, not even the file names — every archive is named for an id, never a client.
And what the host is left with is nothing. Working copies are removed the moment the drive has the session; pre-migration snapshots are removed once the pass that needed them has committed; a copy stranded by a pulled drive is collected at the next start. This is the leftover the product exists not to leave.
What it does not do
Said here because a tool that holds other people’s credentials should be the one volunteering its limits.
- It is retention, not a second lock. One master password opens both halves. Whoever can reach the names can reach the secrets by typing it again. What the split buys is that secrets are not sitting open all afternoon because you glanced at a client list.
- It cannot protect you from malware running as you. Nothing that runs on your machine can. The threat it answers is a lost drive, a shared login, a laptop left open.
- It is unsigned, and it is alpha. Windows will warn you. That warning is doing its job — every build goes out with its SHA-256 so you can check what you got.
Alpha, by invitation.
Builds go out by hand for now, each with its SHA-256. Read the security page, then ask.