Two surfaces that are the first thing anyone meets, and neither is finished.
The gate
It is the highest-stakes form in the application: a passphrase that cannot be recovered, typed twice, that seals everything. And:
- No reveal. Neither field can be shown. Both are typed blind, and the only feedback is "les phrases ne correspondent pas" after the fact.
autocomplete="off" on both fields, which blocks a password manager. ⚠️ A manager is precisely what makes "no recovery" survivable, and it is the one place a long random phrase comes from. Worth a deliberate decision rather than a default: current-password on unlock and new-password on creation is the standard pairing, and it is also what stops a browser offering to save the wrong field.- No minimum until it is refused. The length rule exists and only speaks after a submit.
- The panel sits high, with the bottom third of the window empty.
None of this is about the crypto, which is sound. It is about the one moment the user has to get right.
The titlebar
- Three macOS traffic lights that do nothing.
<span class="dot r">, .y, .g, aria-hidden, no handler — decoration, drawn on Windows under the real window buttons. They are the universal control for close / minimise / zoom, so they invite a click that does nothing at all.
- FR / EN occupies the top right, which on Windows is where the window controls are, and it duplicates the "Langue" preference three clicks away. A language is chosen once.
- 38 px of a second titlebar for two menus, under the operating system's own.
Shape
- A reveal toggle on both fields (
aria-pressed, and the type flipped — not a second plaintext input).
autocomplete="new-password" on creation, current-password on unlock. ⚠️ Decide it and write the reason down; the current off reads as an oversight rather than a choice.- State the minimum before it is broken, not after.
- Centre the panel.
- Either wire the three dots to
minimize / toggleMaximize / close and drop the real decorations, or remove them. ⚠️ closeToTray is on by default and WINDOW_STATE_FLAGS deliberately omits VISIBLE — a close button has to go through the same path the tray does, or the next launch restores a hidden window.
- The locale switch moves into the preferences, where its twin already is.
Done when
The passphrase can be seen while it is typed and a password manager can fill it, the gate is centred, and nothing in the titlebar invites a click that does nothing.
Two surfaces that are the first thing anyone meets, and neither is finished.
The gate
It is the highest-stakes form in the application: a passphrase that cannot be recovered, typed twice, that seals everything. And:
autocomplete="off"on both fields, which blocks a password manager.current-passwordon unlock andnew-passwordon creation is the standard pairing, and it is also what stops a browser offering to save the wrong field.None of this is about the crypto, which is sound. It is about the one moment the user has to get right.
The titlebar
<span class="dot r">,.y,.g,aria-hidden, no handler — decoration, drawn on Windows under the real window buttons. They are the universal control for close / minimise / zoom, so they invite a click that does nothing at all.Shape
aria-pressed, and the type flipped — not a second plaintext input).autocomplete="new-password"on creation,current-passwordon unlock.offreads as an oversight rather than a choice.minimize/toggleMaximize/closeand drop the real decorations, or remove them.closeToTrayis on by default andWINDOW_STATE_FLAGSdeliberately omitsVISIBLE— a close button has to go through the same path the tray does, or the next launch restores a hidden window.Done when
The passphrase can be seen while it is typed and a password manager can fill it, the gate is centred, and nothing in the titlebar invites a click that does nothing.