Guide 2.0

How to use Stateless Gen 2.0

Gen 2.0 is the beta flow for generating passwords and recording Security Map metadata into an encrypted state file. YubiKey is available now; passkey and biometric routes are planned.

Website ID + Master Password + YubiKey PRF = Password + Map Entry

Start here

Choose your Gen 2.0 route

The first page shows three routes. Only YubiKey opens a working beta tool today.

1. Open Stateless Gen 2.0
goblinpassuk.github.io/stateless-gen2.html
YubiKey / Security Key Available now
Windows Hello Passkey Coming later
Biometrics Coming later
2. Open the YubiKey beta
stateless-gen2-yubikey.html

Status: not connected.

A state file is required before the map can be saved or exported.

Encrypted state

Create, open, or reconnect your state file

The state file stores map metadata such as ID, website, method icons, hint, length, and counter. It does not store the generated password.

Create beta state

Use this for a fresh Gen 2.0 test. Save the exported file somewhere you can find again.

Open state file

Use this when you already exported your latest Gen 2.0 state and want to continue from it.

Reconnect remembered file

If the browser remembers a previous file handle, this reconnects it so saving can update the same state file.

Generate

Fill in the generator and sign with YubiKey

When YubiKey is selected, Gen 2.0 must sign in during generation. If the browser cannot return real PRF data, the tool should stop rather than create a different fallback password.

3. Fill in the generator
YubiKey
Generate & CopyAuto-record on
4. Confirm the YubiKey prompt
Windows Security

Sign in to GoblinPass

Choose your physical security key if Windows offers more than one option.

USB
Enter the key PIN if asked, then touch the YubiKey.

The returned PRF value becomes part of the password recipe.

Security Map

Auto-record and manage the map entry

With auto-record on, a generated password adds or updates the matching row in the encrypted Security Map state.

5. Check the hidden map row
IDSiteMethodHintLengthCounterEditView
161EditShow
6. Reveal, edit, or delete only when needed

Map entries hidden.

Clicking a row also fills the generator with that entry's ID, website, length, counter, and method metadata.

Settings

Use settings for optional factors

Optional factors should be enabled deliberately. If a factor affects generation, you need the same factor later to recreate the same password.

7. Google Security Factor
Google Security Factor

Google Sign-In

Uses the stable Google account subject ID as an extra password ingredient.

Set up Google Sign-InSign out
8. Trusted Device Protection
Enable Trusted Device Protection

Trusted Device Protection: Enabled - Recovery Key: Not backed up

Show Recovery KeyRestore Trusted Device

Finish safely

Save or export after changes

After generating, editing, or deleting entries, save/export the latest state file. The newest state is the one you should keep and import next time.

Recommended habit

  1. Open or reconnect your latest state file.
  2. Generate the password with auto-record on.
  3. Check the map row was added or updated.
  4. Save/export the updated state.
  5. Keep the newest exported state somewhere private.

What not to rely on

Do not rely on memory alone if you are using Gen 2.0 map metadata. The state file is what keeps ID, website, method icons, hint, length, and counter together.

Do not enable optional factors unless you are prepared to use the same factor again later.