Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →HOLogram’s Input Vault is a proposed privacy module, not a working cross-browser shield. Its design aims to intercept keyboard events, remove identifying timing patterns, and re-emit events with the meaning of the user’s input intact. The project’s own article and repository say that key implementation questions remain open and that the reference implementation and compliance tests are still in progress.
What the Input Vault is designed to do
HOLogram describes the Input Vault as its first module. The proposal is to intercept native keyboard events, strip out typing micro-timings that might contribute to behavioral identification, and emit synthetic events that preserve the input needed by a page. The project’s design principle is: “The semantic content of what you type must be preserved exactly. The temporal pattern must not.” That is an intended privacy boundary, not a result demonstrated by a completed implementation.
As an Amazon Associate I earn from qualifying purchases.
The repository similarly says, “The content of every interaction is preserved exactly.” This is a project-stated design property, not a measured guarantee that synthetic events are indistinguishable from native events or work with every website.
Free tools Windows power users keep installed
One-click scans. No signup required.
HOLogram describes other planned components, including pointer and scroll normalization, a persona mixer, differential-privacy processing, and exposure budgeting. Those broader parts of the architecture do not establish that the Input Vault—or the other modules—currently provides working protection.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why a capture-phase listener may not be early enough
A browser extension content script can register a document event listener in the capture phase. That listener runs before event handlers on the target element and before bubbling listeners. But this ordering does not, by itself, hide the original keyboard event from the page: page code can also register a document capture listener and may observe the real event and its timestamp.
In other words, being early in the event-propagation sequence is not the same as intercepting input before page JavaScript can see it. The central engineering question is whether a browser-specific interception point exists that prevents the page from observing the original event—not merely whether extension code can handle the event first.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Interception approaches under investigation
The project article discusses several possible directions but does not establish a solution that works across browsers or arbitrary websites.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Approach | What it might offer | Unresolved constraint |
|---|---|---|
| Content-script capture listener | Runs before target and bubble listeners in the event-propagation sequence. | A page’s own capture listener may still observe the original event and timestamp. |
| Window-level interception | Could be investigated as another place to handle events early. | The project article does not establish that it prevents page scripts from seeing the original input. |
| Shadow DOM isolation | Could isolate events when the module controls the relevant input element. | Controlling or replacing input elements is a limitation on arbitrary existing pages. |
| Browser-native input interception | Could potentially provide an earlier boundary than page-level event handling. | API availability, behavior, and required permissions vary across Chrome, Firefox, and Safari; no universally available route is established. |
These are research directions, not proven recommendations. The material available from the project does not identify a validated implementation that wins across the relevant criteria: how early it intercepts, whether the original event remains observable, whether it requires control of input elements, browser availability and permissions, event fidelity, and composition-input support.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What re-emitted events would need to preserve
Changing timing while retaining usable input requires more than reproducing the characters typed. The project article’s design checklist includes preserving:
- Key identity, including
key,code, and the legacy fields named in the article. - Modifier state, such as whether a modifier key is active.
- The expected event sequence.
- Event properties including bubbling, cancelability, and composed behavior.
This is a list of requirements for the proposed design, not evidence that synthetic events can meet them consistently or that websites will treat them like native input. Whether the timing signal can be changed without breaking site behavior remains a matter for implementation and testing.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
IME and composition input are open questions
Input Method Editors (IMEs) often rely on composition events—compositionstart, compositionupdate, and compositionend—rather than only the usual keydown, keypress, and keyup pattern. The project article does not provide a validated handling strategy. As BaffiSan’s DEV Community article puts it, “How the Input Vault handles IME input is an open question.”
Recommended Free Tools
That leaves support for Chinese, Japanese, Korean, Arabic, and other IME or composition-based input unestablished. It needs testing in real browsers; the design description is not a basis for claiming that these input methods are supported.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Current development status
As of October 7, 2026, HOLogram’s GitHub repository reports the whitepaper as published, while the reference implementation, HOLogram Layer Protocol specification, and compliance tests are in progress. The repository also says the project is seeking contributors. These are maintainer-reported status statements, not an independent audit or confirmation that the implementation is complete.
What would need to be answered before relying on it
The project article points to the practical work still needed to assess the Input Vault:
- Identify the earliest interception point for each browser and test whether any route truly prevents page scripts from seeing the original event.
- Establish which manifest permissions each browser requires and how browser-specific API behavior affects the design.
- Measure timing differences and verify that the approach changes the timing signal without disrupting the event semantics sites need.
- Develop and test safe handling for IME composition and other composition-based input.
- Complete the reference implementation and compliance tests so behavior can be evaluated against a defined specification.
Until those questions are resolved, the Input Vault is best understood as a proposed way to separate the meaning of typed input from its timing pattern—not as protection users can currently count on.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
