A ground-up rebuild of the web console for the Cryptsoft KMIP server: two interchangeable layouts on one engine, engineered accessibility, white-label branding, nine languages — and a genuine post-quantum key-management story you can run today.
Keyward ships as two front-ends that share a single engine. Cryptsoft Keyward is a dense, left-sidebar operations console for power users running day-to-day key operations. Cryptsoft Keyward Classic is a streamlined top-navigation layout built for clarity and quick orientation. Because both are driven by the same shared core, every capability below — theming, accessibility, white-labelling, nine languages, the full KMIP feature set — is identical across the two. An operator picks the layout that suits them; the substance never changes.
Under both sits the same console: a dashboard with host information, recent events, and key-type and key-state breakdowns, plus dedicated pages for Objects, Certificates, Devices, Administrators, Tokens, HSMs, Logs (traffic, events and HSM activity), Scripts, and system setup.
The console understands and surfaces NIST-track post-quantum algorithms (ML-DSA / Dilithium) alongside classical ones — listing, inspecting and managing PQC keys with the right length and type detail. You can run a post-quantum key estate today, ahead of the migration deadline rather than after it.
Administrator sign-in is passwordless and phishing-resistant: FIDO2 / WebAuthn passkeys, where an administrator enrols a biometric or security key and logs in with it — no shared secret to steal. Standard TOTP multi-factor, with in-app QR enrolment, is built in alongside.
And a forward look: Keyward includes hybrid post-quantum passkeys — enrolment binds a classical key (ES256 / P-256) and a post-quantum key (ML-DSA) into one credential, so a break in either algorithm doesn't compromise it. This capability is experimental and bleeding-edge, and labelled as such in the product — it's the practical shape of NIST-track PQC migration, not a hardened promise. Managing PQC keys and signing in with FIDO2 passkeys, by contrast, are solid, shipping capabilities today.
Keyward ships built-in high-contrast and true two-tone monochrome schemes in every build. These don't just recolour: a dedicated structural layer thickens borders, inverts selected states, outlines status pills, and flattens decorative shadows so the interface stays unambiguous at a glance.
The accessibility palettes use the published Okabe–Ito colour-universal-design palette, designed to stay distinguishable for the common forms of colour blindness — and colour is never the only cue. Every coloured datum (object types, chart slices, status) also carries a shape or glyph and a distinct texture pattern, so a red-green colour-blind user reads a chart by its patterns and labels, not its hues. The UI also honours the operating system: if it requests more contrast, Keyward defaults to a high-contrast theme. Accent colours that carry text are re-checked to WCAG AA (4.5:1) contrast ratios on every build, so a future tweak can't silently ship an unreadable theme.
An in-app theme switcher lets users recolour the whole console live — no reload, no redeploy — from a curated library that includes familiar developer palettes (Solarized, Dracula, Gruvbox, Iceberg, Rosé Pine) and clean house palettes, plus light, dark and follow-the-OS modes.
Branding is a separate axis entirely. You can re-brand a deployed site — colours, logo, product name, favicon and title — from an editable config file the built site loads at startup. Change it, reload, done: ship one build and brand it for every customer, with no recompile and no flash of the wrong brand before first paint.
Keyward ships in nine languages — English, German, Spanish, French, Japanese, Polish, Simplified Chinese, Arabic and Hebrew — with Arabic and Hebrew bringing full right-to-left layout support. Shared KMIP terminology is translated once in the core and reused across both layouts.
The console is purpose-built for the Cryptsoft KMIP server: the dashboard surfaces server version, FIPS capability, uptime, and live event, traffic and HSM logs. It talks to the server over native KMIP directly or over REST, with the same UI on top. Operators can even inspect and run server-side scripts from the console, with syntax-highlighted source that themes its own colours to match the active theme.
"Manages post-quantum keys" and "supports post-quantum passkeys" is a rare pairing — the strongest future-proofing story we can put in front of a security-conscious buyer, wrapped in a console that is accessible, brandable and multilingual out of the box. That's Keyward.
