I understand what you are saying and thank you for offering your thoughts.

The app doesn't do any type of hashing. The app just intercepts your keystrokes as you type and replaces what you type with a random character. I would of thought the validation would be through giving it a try and using it.

In regards to signing the binary, i didn't want to buy a code signing cert until I had some positive feedback and it was worth getting.

Again i understand your concerns and thank you for the feedback.