Life & fun · alternatives · 2026
24 alternatives to Hardware-backed end-to-end message encryption, in the browser
When I first discovered WebAuthn in 2019 I imagined it being used for something like this, but never imagined something like the prf extension enabling true E2EE like this. Everything happens in the browser; there's no server used in any of this because to me that defeated the purpose. I also challenged myself to make a decent UX on top of this because what good is strong encryption if it's not usable? For best results make sure you're using Chrome 116 and a recent FIDO2 security key.
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. Hardware-backed end-to-end message encryption, in the browser launched in 2023; newer entries below may have overtaken it.
- 1
HTTPS Everywhere▲290Chrome extension that encrypts and secures your browser
2017 · chromewebstore.google.com · its alternatives →
- 2
Platform-Agnostic Security Tokens. Contribute to paragonie/paseto development by creating an account on GitHub.
2018 · github.com · its alternatives →
- 3
- 4
Send secret messages using Web Crypto API 🤫.
2024 · webcrypto-private-messages.vercel.app · its alternatives →
- 5
A Virtual FIDO2 USB Device. Contribute to bulwarkid/virtual-fido development by creating an account on GitHub.
2022 · github.com · its alternatives →
- 6
- 7CM
2018 · cipherbrowser.com · its alternatives →
- 8
This project has been kicking around in my head since I first heard about the webauthn PRF extension in early 2024. I've slowly chipped away at it since, and finally got things to a shareable state over the summer thanks to a very fun parental leave. Headed back to work tomorrow, so I figure there's no time like the present. tldr: A client-held encryption key derived during passkey authentication encrypts all sensitive user data prior to persistence so that only the user is able to decrypt and reuse that data on their device. This allows short-lived, privacy-preserving age proofs to be…
Aug 2026 · loginwithone.com · its alternatives →
- 9
Seald SDK▲108Protect your users' data with end-to-end encryption.
2021 · seald.io · its alternatives →
- 10
Send files securely without leaving your Slack channel!
2020 · its alternatives →
- 11ES
Using Slack video blocks to share PGP encrypted messages inside the Slack client
Jun 2026 · v1c.rocks · its alternatives →
- 12
Signed Pages▲75A browser extension to verify the authenticity of websites
2018 · github.com · its alternatives →
- 13
CypherChat▲69Secure. Encrypted. Peer-to-Peer. No Personal Info Sign-up.
2022 · cypherchat.app · its alternatives →
- 14
BoringSSL and nghttp2. Matches JA3N, JA4, and JA4_R fingerprints. Supports HTTP/2, async/await, and works with Cloudflare-protected sites. Not trying to compete with curl_cffi - just a learning project that turned into something functional.
Nov 2025 · github.com · its alternatives →
- 15
Hello. I made this project as an experiment in using key cryptography for user identity in a client server model, and for some future peer to peer projects that I am working on. I am looking for feedback, please let me know what you think. Also, Merry Christmas to HN! :-)
2022 · github.com · its alternatives →
- 16
This is an educational reference implementation showing how to build reasonably secure, standards-compliant authentication from first principles on Cloudflare Workers. Stack: Hono, Turso (libSQL), PBKDF2-SHA384 + normalization + common-password checks, JWT access + refresh tokens with revocation support, HTTP-only SameSite cookies, device tracking. It's deliberately minimal — no OAuth, no passkeys, no magic links, no rate limiting — because the goal is clarity and auditability. I wrote it mainly to deeply understand edge-runtime auth constraints and to have a clean Apache-2.0 example that…
Feb 2026 · github.com · its alternatives →
- 17EA
2016 · encrypt-and-destroy.herokuapp.com · its alternatives →
- 18
Jun 2026 · droplock.apitman.com · its alternatives →
- 19
So the main purpose here is to show _a_ way that session-token theft can be mitigated. Clearly, this isn't NSA proof or something you'd use to secure a BL5 containment facility, but to prevent session-jacking; if feels like it could help a lot, and would be pretty quick and easy to roll out if an IDP wanted to implement it.
2024 · github.com · its alternatives →
- 20
Browser based RSA Encrypted message sharing with public/private keypairs - tomw1808/rsa-message-sharing
2016 · github.com · its alternatives →
- 21
Hi everyone, I am a big privacy activist and the amount of privacy concerns in the internet with the discussions around European Chat Control, Meta removing e2ee in Instagram and corporations harvesting personal data for AI training is on the rise. The closed source social media companies keep managing and storing our private keys, allowing them to effectively access all of our personal communications.. Many open source alternatives exist, but the problem I kept running into was not a lack of good private messengers. Signal, SimpleX, and other projects already do important work The problem…
Jul 2026 · useekko.app · its alternatives →
- 22TS
Hi HN! Keen to get your thoughts on an encrypted messaging app I've made: throwaway is an in-browser messaging app. It's specifically for single-use, one-to-one, e2e encrypted messaging. This means your messages are encrypted in your browser, and they are only decrypted when they reach your recipients browser. The messages disappear permanently once both browser windows have closed. You can never recover a throwaway chat; once the window is closed, it's gone forever. throwaway uses the SubtleCrypto Web API to create a public/private key pair every time it is opened/refreshed (ECDH…
2022 · throwaway.sh · its alternatives →
- 23
Hey everyone, English is not my native language. This post was polished with AI, but the content is mine. I run a small dev agency in Germany. Every week someone shares database credentials, API keys, or a .env file via Slack or email. Not because they don’t care: because there’s no frictionless alternative. Vault setups are heavy. Enterprise tools are expensive. I just needed: upload → share link → done. But encrypted before leaving the browser. So I built SecretDrop.dev. What it does Files encrypted client-side (AES-256-GCM, PBKDF2 600k iterations) Built entirely on WebCrypto No…
Feb 2026 · secretdrop.dev · its alternatives →
- 24
Shark WebAuthn library for .NET
2025 · github.com · its alternatives →
Also compare
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →