I was looking at the password list in Krypt and thought it could use one small improvement: website icons.

Most password managers show a familiar logo next to each login — GitHub, Amazon, Google, whatever. It makes the list easier to scan and looks better than a row of generic icons.

It also seemed trivial to implement.

Take the URL stored with a password, extract the domain, fetch the website's favicon, cache it locally, and display it next to the entry.

Then I stopped at the word fetch.

Krypt is designed as an offline password manager. There are no accounts, no cloud vault and no backend holding your passwords. Your vault stays on your device.

Fetching a favicon changes something surprisingly fundamental.

If Krypt contains a login for example.com, getting that little icon means making a request to example.com. The request doesn't contain the password or username, but it still comes from the user's device and IP address.

In most cases this isn't particularly alarming. If you have an Amazon login, you've probably visited Amazon before. Amazon already sees network traffic from your device.

But now the request is being made because your password manager contains an Amazon credential, not because you decided to visit Amazon.

That's a subtle difference, but for an offline password manager, it matters.

AutoFill doesn't create the same problem. When you use Krypt through iOS Password AutoFill, you're already in the app or on the website. iOS asks Krypt's local AutoFill extension for a matching credential, and Krypt supplies it from its local mirror. AutoFill responds to a connection the user has already made. Website icons would require Krypt to make a new connection based on what's stored in the vault.

There are services specifically designed to solve the icon problem. Give them a domain and they return its favicon. Technically, that's convenient. Privacy-wise, I like it even less.

Instead of GitHub receiving a request for its own icon, a third party could potentially receive a stream of domains from the user's password list. No passwords have been disclosed, but that list can still say quite a lot.

Krypt could avoid that by fetching icons directly from each website, stripping everything except the domain, sending no cookies or authentication data, and caching each icon locally. That would make the privacy impact quite small.

But it wouldn't make it zero.

The code was easy. Deciding whether the app should make the request wasn't.

The moment Krypt fetches that first icon, an app designed to keep the vault local has initiated network activity based on something stored inside it.

All for a prettier password list.

So I didn't add it. At least not yet.

I may eventually decide that direct favicon requests with strict privacy rules are a reasonable compromise. Most users would probably prefer having the icons.

But this was a useful reminder while building privacy software: sometimes a tiny UI improvement isn't quite as tiny as it looks.