For contractors and consultants who hold several client tenants
One browser per client.
Their credentials in a vault.
On a stick you take home.
A separate Chrome profile for every client, opened together with their sites and their logins. Every client’s Outlook, Microsoft Teams and SharePoint at the same time, each signed in as the right person, with a master-password vault that does the copying so nothing sensitive ever reaches the page. Install it, or run it entirely from an encrypted USB drive that leaves nothing behind on a machine you were only visiting.
- No network
- No telemetry
- No administrator rights
two contexts up · the frame takes the context colour · each signed in as its own person
Three clients. Three Microsoft tenants. One browser that keeps signing you into the wrong one.
Incognito windows forget everything nightly. Browser profiles work until you have to remember which one holds which login. Password managers keep the secrets and know nothing about which session they belong to. And the whole arrangement lives on one laptop. Walk up to a client desk and none of it is with you.
WorkCtx opens every tenant’s Outlook and Microsoft Teams side by side, each in its own browser, each signed in as the right account, none of them able to see the others. A client is a context: one browser profile, its sites, its accounts and their secrets, opened together and closed together. If you want, the whole context travels on an encrypted drive that opens on any machine and leaves it as it found it.
How it works
Take it with you
The whole product on a USB stick, Windows, Linux and macOS from one drive.
- Each client’s profile is one encrypted archive on the drive.
- Runs from a fast working copy, sealed back when the context closes.
- A session stranded by a crash is recovered at the next start.
- Nothing readable left on a borrowed host.
A context is a client
Its own Chrome profile, colour, sites, accounts and apps.
- Outlook and Microsoft Teams for every tenant, open at the same time, each signed in as the right person.
- Sign into the same tenant as three different people, at once.
- Sites open on start; Microsoft Teams and the rest launch alongside.
- Per-monitor window placement, remembered per context.
A vault, not a password list
Argon2id and AES-256-GCM, calibrated on the machine it is made on.
- The copy happens in the agent. Plaintext never reaches the browser page.
- Clipboard clears itself, and keeps the copy out of Windows clipboard history and cloud sync.
- TOTP codes with a live countdown.
- Secrets stay unlocked for minutes, client names until the screen locks or the agent exits.
The part with no obvious equivalent.
A browser profile on a stick is small random I/O on slow flash: thirty seconds to open a context, measured. So WorkCtx does not run from the drive. It unseals the client’s profile into a working copy on the host’s own disk, runs the browser there, and seals it back to the drive when the context closes.
What the drive holds, at every moment, is ciphertext. A stick lost on a train gives up nothing: not the sessions, not the client names, not even the file names. Every archive is named for an id, never a client.
And what the host is left with is nothing. Working copies are removed the moment the drive has the session; pre-migration snapshots are removed once the pass that needed them has committed; a copy stranded by a pulled drive is collected at the next start. This is the leftover the product exists not to leave.
What it does not do
Said here because a tool that holds other people’s credentials should be the one volunteering its limits.
- It is retention, not a second lock. One master password opens both halves. Whoever can reach the names can reach the secrets by typing it again. What the split buys is that secrets are not sitting open all afternoon because you glanced at a client list.
- It cannot protect you from malware running as you. Nothing that runs on your machine can. The threat it answers is a lost drive, a shared login, a laptop left open.
- It is unsigned, and it is alpha. Windows will warn you. That warning is doing its job: every build goes out with its SHA-256 so you can check what you got.
Alpha, by invitation.
Builds go out by hand for now, each with its SHA-256. Read the security page, then ask.