Deployment

Installing on a machine with no internet

For air-gapped workstations, isolated networks and locked-down environments

What the machine needs

• Windows 10 (64-bit) or Windows 11.
• Microsoft Edge WebView2 Runtime — the Microsoft component ShiftMask uses to draw its window. This is the only prerequisite.
• No Python, no .NET, no administrator rights for ShiftMask itself. It installs for the current user only and writes nothing to Program Files.

On a machine that has internet, ShiftMask handles this for you: if the runtime is missing it explains the situation, asks for your permission and installs it, then carries on. On a machine that does not, the runtime has to be carried in — which is what the rest of this page is about.

We do not put a private copy of the runtime inside our installer. It is around 200 MB, twenty times the size of everything else we ship, and Microsoft patches it for you on machines that are online. Bundling our own copy would make us, not Microsoft, responsible for shipping you security fixes for it. We would rather not be in that position, and neither would your security team.

Check whether the runtime is already there

Do not assume it is. On a freshly imaged Windows 11 Enterprise machine it is usually not installed, despite what Microsoft's documentation implies. We checked.

Run this in PowerShell on the target machine:

$id = "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"
"HKLM:\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\$id",
"HKLM:\SOFTWARE\Microsoft\EdgeUpdate\Clients\$id",
"HKCU:\SOFTWARE\Microsoft\EdgeUpdate\Clients\$id" |
  ForEach-Object { (Get-ItemProperty $_ -Name pv -ErrorAction SilentlyContinue).pv }

A version number (for example 153.0.4234.32) means the runtime is installed and you can skip to step 3. No output means it is missing. A value of 0.0.0.0 also means missing — that key is left behind when the runtime is uninstalled.

What to bring to the machine

Two files, both downloaded on a machine that does have internet:

• ShiftMask-win-Setup.exe — from your ShiftMask download link.
• The WebView2 Evergreen Standalone Installer (x64) — about 203 MB, from Microsoft's WebView2 download page. Pick “Evergreen Standalone Installer”, not “Evergreen Bootstrapper”: the bootstrapper is a small downloader and needs internet at the moment you run it.

Both files are signed. ShiftMask's installer is signed by 4optima Sp. z o.o. — verify it before you carry it anywhere:

Get-AuthenticodeSignature .\ShiftMask-win-Setup.exe | Format-List Status, SignerCertificate

Step 1 — Copy both files onto the machine's local disk

Not optional

Step 2 — Install the WebView2 Runtime

Double-click the standalone installer and let it finish. It takes roughly a minute and a half and shows Microsoft's own progress window.

For unattended or scripted deployment:

Start-Process "C:\Install\MicrosoftEdgeWebView2RuntimeInstallerX64.exe" `
  -ArgumentList "/silent","/install" -Wait

Installing the runtime machine-wide may require local administrator rights in your environment; ShiftMask itself does not.

Then re-run the check from the top of this page. Confirm you get a version number before moving on. The installer can report success and still not have installed anything — the registry is what decides, not the exit code.

Step 3 — Install ShiftMask

Run ShiftMask-win-Setup.exe. It takes about 20 seconds, needs no administrator approval, and installs for the current user only:

• Application: %LOCALAPPDATA%\ShiftMask — around 285 MB.
• Your data, including the vault: %LOCALAPPDATA%\4optima\ShiftMask, kept separately so that uninstalling ShiftMask never removes it.
• Nothing in Program Files, nothing in the registry beyond the usual per-user uninstall entry.

ShiftMask starts and shows the activation screen. The footer reads OFFLINE · 0 BYTES SENT.

Step 4 — Activate

Activation is fully offline. The screen shows this device's ID; send it to us with your purchase and you get back a licence token that begins with SM1-. Paste it in and press Activate. No network call is made at any point — the token carries a signature that ShiftMask verifies locally.

Two things worth doing on day one

Back up the vault. It holds the map between your real values and their stand-ins, and it lives in %LOCALAPPDATA%\4optima\ShiftMask — which most corporate backup policies do not cover. Without it, results from earlier runs can never be matched back to real records.

Store the vault password where the company keeps other critical secrets. There is no recovery. That is a property of the encryption, not a missing feature: if the password is lost, the project's stand-ins can never be connected to real records again, including everything already exported.

If something goes wrong

“ShiftMask cannot start”

The WebView2 Runtime is missing. Go back to step 2 and confirm the registry check returns a version.

The WebView2 installer finished in about a second and nothing happened

You ran it from a USB stick or a network share. Copy it to a local disk and run it again. This is the most common failure on this page.

The registry check returns 0.0.0.0

Treat it as not installed. The key survives uninstallation of the runtime.

Still stuck

Open Help inside ShiftMask and use “Report a problem”. It builds a plain-text diagnostic report locally that you can read in full before sending anything, and it contains no values from your data. Send it to shiftmask@4optima.pl, or see the support page if this machine has no mail client.