What protects your Skyward login
Skylight has to be able to sign in to Skyward as you. Everything below follows from one rule: hold as little as possible, and make what is held useless to someone who only has the database.
Your password is the key, and Skylight does not have it
When you sign in, your Skylight password is stretched into a key that never leaves the request. That key unwraps the data key, and the data key opens your encrypted Skyward login and grades. Sign out and the server is holding ciphertext again.
Envelope encryption
AES-256-GCM with a data key generated for you alone. That key is itself wrapped by a key derived from your Skylight password, so the stored ciphertext is useless without you.
PBKDF2-SHA256, 600,000 iterations
Your Skylight password is stretched 600,000 times before it becomes a key, which is what makes guessing it expensive.
Sealed session cookies
Sessions are HttpOnly and SameSite, and the cookie itself is encrypted — JavaScript cannot read it and another site cannot borrow it.
Rate limiting
Sign-in, sign-up, account changes and the credential-taking sync are all rate limited, so Skylight cannot be turned into a password-guessing proxy pointed at the school.
Strict CSP with nonces, and HSTS
Only Skylight’s own scripts are allowed to run, each page load marks them with a fresh nonce, and browsers are told to reach the site over HTTPS only.
Encrypted push
Push messages are encrypted to your device, so the push service that relays them cannot read what they say.
Three levels, and what each one really means
You pick one in Settings and can change it whenever you like. Stepping back down deletes what was stored.
| Level | Account | Skyward login | Grades | Background checks | In short |
|---|---|---|---|---|---|
| Guest | None | Never stored | This browser tab only | No | Nothing at all is saved on the server. |
| Saved & encrypted | Yes | Encrypted | Encrypted | No | Readable only while you are signed in. |
| Background alerts | Yes | Encrypted, plus a server-key copy | Encrypted, plus a server-key copy | Every 15 min | Opt-in. A weaker guarantee — see the warning below. |
Background alerts is deliberately the weaker option, and this is the honest version. To check for new grades while you are asleep, the server has to be able to open your vault without you — so a second copy of your data key is locked with a server secret. Someone who obtained both the database and that secret could read the Skyward login. That is a strictly weaker guarantee than Saved & encrypted on its own, which is why it is opt-in and spelled out before you turn it on.
The limits of all this
Your Skyward password is used only to sign in to Skyward on your behalf. It is not used for anything else. In guest mode it is never stored; with an account it is stored only as ciphertext that your Skylight password opens.
Skylight cannot be safer than Skyward. Anyone who knows a student's Skyward login can already read everything Skylight shows by signing in to Skyward directly, and can use that login to reset that student's Skylight password. Guard the school login first.
No security page is a proof. Skylight is a small independent project, it has not been audited, and it is not affiliated with Skyward, Qmlativ or Plano ISD. If you would rather no copy of your login existed anywhere, use guest mode — it needs no account and stores nothing on the server, and it exists for exactly that preference.
Pick the level you are comfortable with
Guest mode stores nothing at all. You can change your mind later without losing your account.