encryption
Infisical is an open-source, end-to-end encrypted tool to sync environment variables across your team and infrastructure. Open-source, E2EE, simple tool to manage and sync environment variables across your team and infrastructure.
Onion addresses for anything.
onionpipe forwards ports on the local host to remote Onion addresses as Tor hidden services and vice-versa. onionpipe is a decentralized way to create virtually unstoppable global network tunnels.
The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis.
CyberChef is a simple, intuitive web app for carrying out all manner of "cyber" operations within a web browser. These operations include simple encoding like XOR and Base64, more complex encryption like AES, DES and Blowfish, creating binary and hexdumps, compression and decompression of data, calculating hashes and checksums, IPv6 and X.509 parsing, changing character encodings, and much more.
Related contents:
Store securely encrypted backups in the cloud!
Duplicati is a free, open-source backup client that securely stores encrypted, incremental, and compressed backups on cloud storage services and remote file servers.
Related contents:
One-Time Information Sharing.Encrypted Secret Sharing.
Share sensitive information securely with a link that can only be viewed once.
Related contents:
Minisign is a dead simple tool to sign files and verify signatures.
Web clipboard and simple messanger with end-to-end RSA+AES encryption. Cryptboard.io allows to send text messages and files between multiple devices.
A better alternative for securing our sensitive information online.
The Web Authentication API (also known as WebAuthn) is a specification written by the W3C and FIDO, with the participation of Google, Mozilla, Microsoft, Yubico, and others. The API allows servers to register and authenticate users using public key cryptography instead of a password.
paranoid-grade rust-based encryption utility + cross-platform GUI.
Related contents:
Send private and secure notes.
Enclosed is a minimalistic web application designed for sending private and secure notes.
All notes are end-to-end encrypted, ensuring that the server and storage have zero knowledge of the content. Users can set a password, define an expiration period (TTL), and choose to have the note self-destruct after being read.
Related contents:
Privastead is a privacy-preserving home security camera solution that uses end-to-end encryption
open-source cryptographic APIs.
Welcome to the home of the Legion of the Bouncy Castle and its FIPS-certified open-source cryptographic APIs for Java and C#.
Lightweight modern Python library to add security headers (CSP, HSTS, etc.) to Django, Flask, FastAPI, and more. Secure defaults or fully customizable.
E2EE aware proxy daemon for matrix clients.
Pantalaimon is an end-to-end encryption aware Matrix reverse proxy daemon. Pantalaimon acts as a good man in the middle that handles the encryption for you. Messages are transparently encrypted and decrypted for clients inside of pantalaimon.
age-encrypted secrets for NixOS and Home manager.
agenix is a small and convenient Nix library for securely managing and deploying secrets using common public-private SSH key pairs: You can encrypt a secret (password, access-token, etc.) on a source machine using a number of public SSH keys, and deploy that encrypted secret to any another target machine that has the corresponding private SSH key of one of those public keys.
Related contents:
Simple, self-hostable filesharing application with builtin end-to-end encryption.
Simple and flexible tool for managing secrets.
SOPS is an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, age, and PGP.
SeaweedFS is a fast distributed storage system for blobs, objects, files, and data lake, for billions of files! Blob store has O(1) disk seek, cloud tiering. Filer supports Cloud Drive, cross-DC active-active replication, Kubernetes, POSIX FUSE mount, S3 API, S3 Gateway, Hadoop, WebDAV, encryption, Erasure Coding.
a simple protocol for decentralizing social media that has a chance of working. a truly censorship-resistant alternative to Twitter that has a chance of working.
A better internet is possible: decentralize Twitter, eBay, IoT and other stuff.
Smart-client/dumb-server architecture that can create the free and open internet we were promised.
Keybase maps your identity to your public keys, and vice versa. Keybase is secure messaging and file-sharing.
Password protect static HTML. StatiCrypt uses AES-256 with WebCrypto to encrypt your html string with your long password, in your browser (client side).
Free Cloud Encryption for Dropbox & Co.
Cryptomator offers multi-platform transparent client-side encryption of your files in the cloud.
Related contents:
Private cloud for your photos, videos and more. Fully open source, End to End Encrypted alternative to Google Photos and Apple Photos.
Ente is a service that provides a fully open source, end-to-end encrypted platform for you to store your data in the cloud without needing to trust the service provider. On top of this platform, we have built two apps so far: Ente Photos (an alternative to Apple and Google Photos) and Ente Auth (a 2FA alternative to the deprecated Authy).
Just like nip.io or xip.io, traefik.me is a magic domain name that provides wildcard DNS for any IP address.
A fork of Mozilla's Firefox Send. Mozilla discontinued Send, this fork is a community effort to keep the project up-to-date and alive.
Related contents:
Open source & zero knowledge private note taking app. Open source. End-to-end encrypted.Private. Write notes with freedom, no spying, no tracking.
A fully open source & end-to-end encrypted note taking alternative to Evernote.
Notesnook is a free (as in speech) & open-source note-taking app focused on user privacy & ease of use. To ensure zero knowledge principles, Notesnook encrypts everything on your device using XChaCha20-Poly1305 & Argon2.
gocryptfs uses file-based encryption that is implemented as a mountable FUSE filesystem. Each file in gocryptfs is stored one corresponding encrypted file on the hard disk. The screenshot below shows a mounted gocryptfs filesystem (left) and the encrypted files (right).
End-to-end encrypted IPv6 networking to connect worlds. Yggdrasil is an overlay network implementation of a new routing scheme for mesh networks. It is designed to be a future-proof decentralised alternative to the structured routing protocols commonly used today on the Internet and other networks.
CryptPad is a collaborative office suite that is end-to-end encrypted and open-source.
CryptPad is a collaboration suite that is end-to-end-encrypted and open-source. It is built to enable collaboration, synchronizing changes to documents in real time. Because all data are encrypted, in the eventuality of a breach, attackers have no way of seeing the stored content. Moreover, if the administrators don’t alter the code, they and the service also cannot infer any piece of information about the users' content.
Related contents:
The Dogtag Certificate System is an enterprise-class open source Certificate Authority (CA). It is a full-featured system, and has been hardened by real-world deployments. It supports all aspects of certificate lifecycle management, including key archival, OCSP and smartcard management, and much more. The Dogtag Certificate System can be downloaded for free and set up in less than an hour.
Sealed Secrets provides declarative Kubernetes Secret Management in a secure way. Since the Sealed Secrets are encrypted, they can be safely stored in a code repository. This enables an easy to implement GitOps flow that is very popular among the OSS community.
Reticulum is the cryptography-based networking stack for building local and wide-area networks with readily available hardware. Reticulum can continue to operate even in adverse conditions with very high latency and extremely low bandwidth.
Related contents:
Deduplicating archiver with compression and authenticated encryption. BorgBackup (short: Borg) is a deduplicating backup program. Optionally, it supports compression and authenticated encryption. The main goal of Borg is to provide an efficient and secure way to back up data. The data deduplication technique used makes Borg suitable for daily backups since only changes are stored. The authenticated encryption technique makes it suitable for backups to targets not fully trusted.
Botan (Japanese for peony flower) is a C++ cryptography library released under the permissive Simplified BSD license.
Botan’s goal is to be the best option for cryptography in C++ by offering the tools necessary to implement a range of practical systems, such as TLS protocol, X.509 certificates, modern AEAD ciphers, PKCS#11 and TPM hardware support, password hashing, and post quantum crypto schemes. A Python binding is included, and several other language bindings are available. The library is accompanied by a featureful command line interface.
Baatchit MERN end-to-end-encrypted realtime chat application with features like message reactions, typing-indicators, friend request, last seen, file/gif sharing, edit/delete messages, polling, group chats, user active status, push notifications, pwa, private key recovery, google-auth, otp-verification
OpenPubkey is an open source project that binds public keys and workload identities using standard SSO and OpenID Connect.
Use OpenPubkey today to SSH to machines on your network without SSH keys.
A Go-based GitHub Action that creates cryptographically verifiable attestations for URL content monitoring. This action can be used in any GitHub workflow to generate and verify attestations when the content of specified URLs changes.
Related contents:
A free, fun platform for learning cryptography.
Learn about modern cryptography by solving a series of interactive puzzles and challenges. Get to know the ciphers and protocols that secure the digital world by breaking them.
A complete guide to Nostr.
The simplest open protocol that is able to create a censorship-resistant global "social" network once and for all. A social network for the decentralized era. A simple, open protocol that enables a truly censorship-resistant & global social network.
Delta Chat is a decentralized and secure messenger app.
💬 Reliable instant messaging with multi-profile and multi-device support.
Source-available, FIDO2-native, post-quantum-ready encrypted containers.
Store sensitive files in the cloud, or on shared media without trusting the host. LUKSbox is a Rust-based encrypted-container tool with passphrase, FIDO2 (YubiKey, Titan, Nitrokey, Windows Hello), TPM 2.0, and hybrid post-quantum (ML-KEM-768 / 1024) keyslots. Mounts as a real drive on Linux, macOS, and Windows.
Automated Encryption Framework
Clevis is a pluggable framework for automated decryption. It can be used to provide automated decryption of data or even automated unlocking of LUKS volumes.
- Clevis/Tang: unattended boot of an encrypted NixOS system @ FOSDEM.
- Clevis & Tang on NixOS.
- Safe automatic decryption of LUKS partition using TPM2 @ 221b.
- Automatic LUKS 2 disk decryption with TPM 2 on Fedora @ kowalski7cc.
- Automatically decrypt your disk using TPM2 @ fedora Magazine.
- Use systemd-cryptenroll with FIDO U2F or TPM2 to decrypt your disk @ fedora Magazine.
- Episode 572: Data Security Only a Maniac Could Love @ Linux Unplugged.
FOKS provides a secure, end-to-end encrypted Git hosting service. Your data is encrypted on your machine before it is sent to the server, and the server never sees data or filenames in unencrypted form. This means that even if the server is compromised, your data is safe. FOKS is federated, so the git server can be one that you host, or one that is hosted for you.
Related contents:
Easily send fully encrypted, secure notes or files with one click. Just create a note and share the link.
Reference implementation of OpenPubkey.
OpenPubkey adds user generated cryptographic signatures to OpenID Connect (OIDC) to enable users to sign messages or artifacts under their OpenID identity. Verifiers can check that these signatures are valid and associated with the signing OpenID identity. OpenPubkey does not add any new trusted parties beyond what is required for OpenID Connect and is fully compatible with existing OpenID Providers (Google, Azure/Microsoft, Okta, OneLogin, Keycloak) without any changes to the OpenID Provider.
Related contents:
A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.
age is a simple, modern and secure file encryption tool, format, and Go library. It features small explicit keys, no config options, and UNIX-style composability.
Real fucking shellcode encryptor & obfuscator tool.
Supernova is an open-source tool that empowers users to securely encrypt and/or obfuscate their raw shellcode.
An open source sharing solution built on OpenZiti, the zero trust networking platform. Available as SaaS or self-hosted.
zrok is a next-generation sharing platform built on top of OpenZiti, a programmable zero-trust network overlay. zrok is a Ziti Native Application. zrok facilitates sharing resources both publicly and privately, exposing them to an audience you can easily control.
OpenZiti is a free and open source project focused on bringing zero trust networking principles directly into any application. The project provides all the pieces required to implement a zero trust overlay network and provides all the tools necessary to integrate zero trust into your existing solutions. The OpenZiti project believes the principles of zero trust shouldn't stop at your network, those ideas belong in your application.
Paste a password, confidential message, or private data. Keep your sensitive information out of chat logs, emails, and more with encrypted secrets.
Hemmelig is a encrypted sharing platform that enables secure transmission of sensitive information. All encryption occurs client-side using TweetNaCl, ensuring your data remains encrypted before it reaches our servers. The platform supports both personal and organizational use cases, with features like IP restrictions, expiration controls, and optional password protection. Whether you're sharing credentials, sensitive messages, or confidential files, Hemmelig strives to ensure your data remains private and secure.
the open standard for sealing anything.
The open standard for proving any file is real, unaltered, sealed by a known certificate, and in existence by a certain date. One standard for every kind of file: documents, images, email, code, containers. Verifiable by anyone, forever. The proof travels with the file and stands on its own.
Secure File Sharing.
Self-hostable, open-source, and encrypted by default. Built with RustFS for speed and FastAPI for reliability.
Chithi (pronounced: chee-thee | IPA: /ˈtʃiː θiː/) is an open source end-to-end encrypted file sharing system with a zero trust backend server architecture.
Related contents:
Your end-to-end encrypted backend.
Etebase makes it easy to build end-to-end encrypted applications by taking care of the encryption and its related challenges. Think Firebase but encrypted in a way that only end-users can access their data.
Self hosted, easy to install end to end encrypted storage drive.
Hoodik is a lightweight, secure, and self-hosted cloud storage solution. It's designed and built with Rust and Vue, focusing on end-to-end encryption that shields your data from prying eyes and hackers. Hoodik supports file uploading and downloading, making it easy for you to share files with other users. The simple and intuitive web interface makes file management a breeze. Thanks to Rust's focus on speed and performance, your data transfers will be lightning fast.
Secure peer-to-peer chat that is serverless, decentralized, and ephemeral.
Chitchatter is a free (as in both price and freedom) communication tool. Designed to be the simplest way to connect with others privately and securely.
snarkOS is a decentralized operating system for zero-knowledge applications. This code forms the backbone of Aleo network, which verifies transactions and stores the encrypted state applications in a publicly-verifiable manner.