encryption
OpenPubkey is an open source project that binds public keys and workload identities using standard SSO and OpenID Connect.
Use OpenPubkey today to SSH to machines on your network without SSH keys.
End-to-end encrypted IPv6 networking to connect worlds. Yggdrasil is an overlay network implementation of a new routing scheme for mesh networks. It is designed to be a future-proof decentralised alternative to the structured routing protocols commonly used today on the Internet and other networks.
A fork of Mozilla's Firefox Send. Mozilla discontinued Send, this fork is a community effort to keep the project up-to-date and alive.
Related contents:
Secure File Sharing.
Self-hostable, open-source, and encrypted by default. Built with RustFS for speed and FastAPI for reliability.
Chithi (pronounced: chee-thee | IPA: /ˈtʃiː θiː/) is an open source end-to-end encrypted file sharing system with a zero trust backend server architecture.
Related contents:
Code signing and transparency for containers and binaries. Signing OCI containers (and other artifacts) using Sigstore! Cosign aims to make signatures invisible infrastructure.
Related contents:
Easy, direct connections that punch through NATs & stay connected as network conditions change.
Dumb pipes are Iroh Connections. The dumbpipe tool is a 200-line wrapper around the iroh rust crate. You can use the iroh Endpoint to create a connection to use as a dumb pipe in your own app.
A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.
age is a simple, modern and secure file encryption tool, format, and Go library. It features small explicit keys, no config options, and UNIX-style composability.
Password protect a static HTML page.
StatiCrypt uses AES-256 to encrypt your HTML file with your passphrase and return a static page including a password prompt and the javascript decryption logic that you can safely upload anywhere (see what the page looks like).
This means you can password protect the content of your public static HTML file, without any back-end - serving it over Netlify, GitHub pages, etc. (see the detail of how it works).
CryptPad is a collaborative office suite that is end-to-end encrypted and open-source.
CryptPad is a collaboration suite that is end-to-end-encrypted and open-source. It is built to enable collaboration, synchronizing changes to documents in real time. Because all data are encrypted, in the eventuality of a breach, attackers have no way of seeing the stored content. Moreover, if the administrators don’t alter the code, they and the service also cannot infer any piece of information about the users' content.
Related contents:
Easily and securely send things from one computer to another 🐊 📦
croc is a tool for transferring files and folders between computers. It is fast, secure, and easy to use. It works on any two computers, even if they are behind firewalls or NATs.
Related contents:
Just like nip.io or xip.io, traefik.me is a magic domain name that provides wildcard DNS for any IP address.
This is a ACMEv2 client for Windows that aims to be very simple to start with, but powerful enough to grow into almost every scenario.
age-encrypted secrets for NixOS and Home manager.
agenix is a small and convenient Nix library for securely managing and deploying secrets using common public-private SSH key pairs: You can encrypt a secret (password, access-token, etc.) on a source machine using a number of public SSH keys, and deploy that encrypted secret to any another target machine that has the corresponding private SSH key of one of those public keys.
Related contents:
Minisign is a dead simple tool to sign files and verify signatures.
Real fucking shellcode encryptor & obfuscator tool.
Supernova is an open-source tool that empowers users to securely encrypt and/or obfuscate their raw shellcode.
recover data from the Akira ransomware without paying the ransom.
Open source & zero knowledge private note taking app. Open source. End-to-end encrypted.Private. Write notes with freedom, no spying, no tracking.
A fully open source & end-to-end encrypted note taking alternative to Evernote.
Notesnook is a free (as in speech) & open-source note-taking app focused on user privacy & ease of use. To ensure zero knowledge principles, Notesnook encrypts everything on your device using XChaCha20-Poly1305 & Argon2.
Sealed Secrets provides declarative Kubernetes Secret Management in a secure way. Since the Sealed Secrets are encrypted, they can be safely stored in a code repository. This enables an easy to implement GitOps flow that is very popular among the OSS community.
Cloud native certificate management. X.509 certificate management for Kubernetes and OpenShift.
cert-manager creates TLS certificates for workloads in your Kubernetes or OpenShift cluster and renews the certificates before they expire.
Related contents:
Your private note-taking app.
A self-hosted markdown editor with live preview, document encryption, multi-user support, and multi-organization capabilities.
Privastead is a privacy-preserving home security camera solution that uses end-to-end encryption
Easily send fully encrypted, secure notes or files with one click. Just create a note and share the link.
Self hosted, easy to install end to end encrypted storage drive.
Hoodik is a lightweight, secure, and self-hosted cloud storage solution. It's designed and built with Rust and Vue, focusing on end-to-end encryption that shields your data from prying eyes and hackers. Hoodik supports file uploading and downloading, making it easy for you to share files with other users. The simple and intuitive web interface makes file management a breeze. Thanks to Rust's focus on speed and performance, your data transfers will be lightning fast.
A complete guide to Nostr.
The simplest open protocol that is able to create a censorship-resistant global "social" network once and for all. A social network for the decentralized era. A simple, open protocol that enables a truly censorship-resistant & global social network.
Baatchit MERN end-to-end-encrypted realtime chat application with features like message reactions, typing-indicators, friend request, last seen, file/gif sharing, edit/delete messages, polling, group chats, user active status, push notifications, pwa, private key recovery, google-auth, otp-verification
Fur-ociously Secure, Paw-sitively Adorable!
The purr-fect way to keep your secrets fur-ever safe, straight from the meow-th of your computer to your fur-ends' paws! A fur-ociously secure encryption tool that encodes your secrets as adorable cat and dog sounds, using real elliptic curve cryptography with a playful disguise.
CFSSL is CloudFlare's PKI/TLS swiss army knife. It is both a command line tool and an HTTP API server for signing, verifying, and bundling TLS certificates. It requires Go 1.16+ to build.
snarkOS is a decentralized operating system for zero-knowledge applications. This code forms the backbone of Aleo network, which verifies transactions and stores the encrypted state applications in a publicly-verifiable manner.
Onion addresses for anything.
onionpipe forwards ports on the local host to remote Onion addresses as Tor hidden services and vice-versa. onionpipe is a decentralized way to create virtually unstoppable global network tunnels.
A free, fun platform for learning cryptography.
Learn about modern cryptography by solving a series of interactive puzzles and challenges. Get to know the ciphers and protocols that secure the digital world by breaking them.
SeaweedFS is a fast distributed storage system for blobs, objects, files, and data lake, for billions of files! Blob store has O(1) disk seek, cloud tiering. Filer supports Cloud Drive, cross-DC active-active replication, Kubernetes, POSIX FUSE mount, S3 API, S3 Gateway, Hadoop, WebDAV, encryption, Erasure Coding.
Free Cloud Encryption for Dropbox & Co.
Cryptomator offers multi-platform transparent client-side encryption of your files in the cloud.
Related contents:
A TypeScript implementation of the age file encryption format, available as an npm package or as a bundled .js file.
Related contents:
Lightweight modern Python library to add security headers (CSP, HSTS, etc.) to Django, Flask, FastAPI, and more. Secure defaults or fully customizable.
Open source Dropbox-like file sharing with full client encryption ! Parsec allows you to easily share your work and data in the cloud in total privacy thanks to end-to-end cryptographic security.
Deduplicating archiver with compression and authenticated encryption. BorgBackup (short: Borg) is a deduplicating backup program. Optionally, it supports compression and authenticated encryption. The main goal of Borg is to provide an efficient and secure way to back up data. The data deduplication technique used makes Borg suitable for daily backups since only changes are stored. The authenticated encryption technique makes it suitable for backups to targets not fully trusted.
A Common Approach to IP Address Encryption
IPCrypt is a simple, open specification for encrypting and obfuscating IP addresses, balancing privacy considerations with practical network operations.
Related contents:
The Dogtag Certificate System is an enterprise-class open source Certificate Authority (CA). It is a full-featured system, and has been hardened by real-world deployments. It supports all aspects of certificate lifecycle management, including key archival, OCSP and smartcard management, and much more. The Dogtag Certificate System can be downloaded for free and set up in less than an hour.
Infisical is an open-source, end-to-end encrypted tool to sync environment variables across your team and infrastructure. Open-source, E2EE, simple tool to manage and sync environment variables across your team and infrastructure.
Botan (Japanese for peony flower) is a C++ cryptography library released under the permissive Simplified BSD license.
Botan’s goal is to be the best option for cryptography in C++ by offering the tools necessary to implement a range of practical systems, such as TLS protocol, X.509 certificates, modern AEAD ciphers, PKCS#11 and TPM hardware support, password hashing, and post quantum crypto schemes. A Python binding is included, and several other language bindings are available. The library is accompanied by a featureful command line interface.
A Go-based GitHub Action that creates cryptographically verifiable attestations for URL content monitoring. This action can be used in any GitHub workflow to generate and verify attestations when the content of specified URLs changes.
Related contents:
Store securely encrypted backups in the cloud!
Duplicati is a free, open-source backup client that securely stores encrypted, incremental, and compressed backups on cloud storage services and remote file servers.
Related contents:
Easily and securely send things from one computer to another :package:. croc is a tool that allows any two computers to simply and securely transfer files and folders.
tinc is a Virtual Private Network (VPN) daemon that uses tunnelling and encryption to create a secure private network between hosts on the Internet. tinc is Free Software and licensed under the GNU General Public License version 2 or later. Because the VPN appears to the IP level network code as a normal network device, there is no need to adapt any existing software. This allows VPN sites to share information with each other over the Internet without exposing any information to others.
Simple, self-hostable filesharing application with builtin end-to-end encryption.
Paste a password, confidential message, or private data. Keep your sensitive information out of chat logs, emails, and more with encrypted secrets.
Hemmelig is a encrypted sharing platform that enables secure transmission of sensitive information. All encryption occurs client-side using TweetNaCl, ensuring your data remains encrypted before it reaches our servers. The platform supports both personal and organizational use cases, with features like IP restrictions, expiration controls, and optional password protection. Whether you're sharing credentials, sensitive messages, or confidential files, Hemmelig strives to ensure your data remains private and secure.
Send files securely in real-time.
FileSync is a file sharing web application that allows users to transfer files between multiple devices with end-to-end encryption.
OpenZiti is a free and open source project focused on bringing zero trust networking principles directly into any application. The project provides all the pieces required to implement a zero trust overlay network and provides all the tools necessary to integrate zero trust into your existing solutions. The OpenZiti project believes the principles of zero trust shouldn't stop at your network, those ideas belong in your application.
Share, freely and privately.
Jami is a free/libre, end-to-end encrypted, and private communication software.
Related contents:
get things from one computer to another, safely.
This package provides a library and a command-line tool named wormhole, which makes it possible to get arbitrary-sized files and directories (or short pieces of text) from one computer to another. The two endpoints are identified by using identical "wormhole codes": in general, the sending machine generates and displays the code, which must then be typed into the receiving machine.
Sources:
paranoid-grade rust-based encryption utility + cross-platform GUI.
Related contents:
Tang binding daemon.
Tang is a server for binding data to network presence.
This sounds fancy, but the concept is simple. You have some data, but you only want it to be available when the system containing the data is on a certain, usually secure, network. This is where Tang comes in.
Automated Encryption Framework
Clevis is a pluggable framework for automated decryption. It can be used to provide automated decryption of data or even automated unlocking of LUKS volumes.
- Clevis/Tang: unattended boot of an encrypted NixOS system @ FOSDEM.
- Clevis & Tang on NixOS.
- Safe automatic decryption of LUKS partition using TPM2 @ 221b.
- Automatic LUKS 2 disk decryption with TPM 2 on Fedora @ kowalski7cc.
- Automatically decrypt your disk using TPM2 @ fedora Magazine.
- Use systemd-cryptenroll with FIDO U2F or TPM2 to decrypt your disk @ fedora Magazine.
- Episode 572: Data Security Only a Maniac Could Love @ Linux Unplugged.
Password protect static HTML. StatiCrypt uses AES-256 with WebCrypto to encrypt your html string with your long password, in your browser (client side).
Sha256 algorithm explained online step by step visually.
Sha256 algorithm explained online step by step visually sha256algorithm.com This website will help you understand how a sha256 hash is calculated from start to finish.
Centralized ACME Certificate Management. Your entire PKI at your fingertips.
Cert Warden is a centralized ACME Client. It provides an API for certificate consumers to fetch their individual keys and certs with API keys.
Secure messaging anywhere.
Censorship-resistant peer-to-peer messaging that bypasses centralized servers. Connect via Bluetooth, Wi-Fi or Tor, with privacy built-in.
Related contents: