diff --git a/apps/routerconsole/java/src/net/i2p/router/web/helpers/ConfigKeyringHelper.java b/apps/routerconsole/java/src/net/i2p/router/web/helpers/ConfigKeyringHelper.java
index 4c861fe75..4c2c946fe 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/helpers/ConfigKeyringHelper.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/helpers/ConfigKeyringHelper.java
@@ -1,7 +1,10 @@
 package net.i2p.router.web.helpers;
 
 import java.io.IOException;
+import java.io.Serializable;
 import java.io.StringWriter;
+import java.util.Collections;
+import java.util.Comparator;
 import java.util.List;
 import java.util.Map;
 
@@ -89,7 +92,8 @@ public class ConfigKeyringHelper extends HelperBase {
         // LS2
         if (!local) {
             List<BlindData> bdata = _context.netDb().getBlindData();
-            // TODO sort by hostname
+            if (bdata.size() > 1)
+                Collections.sort(bdata, new BDComparator());
             for (BlindData bd : bdata) {
                 buf.append("\n<tr><td>");
                 String b32 = bd.toBase32();
@@ -141,4 +145,11 @@ public class ConfigKeyringHelper extends HelperBase {
         }
         buf.append("</table>\n");
     }
+
+    /** @since 0.9.41 */
+    private static class BDComparator implements Comparator<BlindData>, Serializable {
+         public int compare(BlindData l, BlindData r) {
+             return l.toBase32().compareTo(r.toBase32());
+        }
+    }
 }
diff --git a/core/java/src/net/i2p/data/BlindData.java b/core/java/src/net/i2p/data/BlindData.java
index e2e0575a5..2e61ecbac 100644
--- a/core/java/src/net/i2p/data/BlindData.java
+++ b/core/java/src/net/i2p/data/BlindData.java
@@ -28,6 +28,7 @@ public class BlindData {
     private boolean _secretRequired;
     private boolean _authRequired;
     private long _date;
+    private String _b32;
 
     /**
      * bits 3-0 including per-client bit
@@ -217,14 +218,17 @@ public class BlindData {
      *  @since 0.9.41
      */
     public synchronized String toBase32() {
-        return Blinding.encode(_clearSPK, _secret != null, _authKey != null);
+        if (_b32 == null)
+            _b32 = Blinding.encode(_clearSPK, _secretRequired, _authRequired);
+        return _b32;
     }
 
     /**
      *  @since 0.9.41
      */
-    public void setSecretRequired() {
+    public synchronized void setSecretRequired() {
         _secretRequired = true;
+        _b32 = null;
     }
 
     /**
@@ -237,8 +241,9 @@ public class BlindData {
     /**
      *  @since 0.9.41
      */
-    public void setAuthRequired() {
+    public synchronized void setAuthRequired() {
         _authRequired = true;
+        _b32 = null;
     }
 
     /**