Alternatives
Products that do what Storing Private Keys in the Browser Securely does
So the main purpose here is to show _a_ way that session-token theft can be mitigated. Clearly, this isn't NSA proof or something you'd use to secure a BL5 containment facility, but to prevent session-jacking; if feels like it could help a lot, and would be pretty quick and easy to roll out if an IDP wanted to implement it.
- 1DB
Google’s recent announcement of a proposed ‘Device Bound Session Credentials’ feature[1] for Chrome reminded me of a project we worked on last year at my company. We focus on fraud prevention at signup and login (preventing multi-accounting and account theft), but some customers were concerned about post-login security and asked us to add a session hijacking prevention feature to our fraud prevention API. In the end, we decided to just implement a solution in Javascript. We call it session-lock, and it can be used today across all browsers[2] and, theoretically, native mobile apps. For a…
2024 · session-lock.keyri.com
- 2RS
Retriever (https://retriever.corgea.io/), an open-source research project to help users receive secrets and sensitive information without needing a server in the middle. It works by using Public-key cryptography to coordinate the message sharing between the two devices. Read more on why we built it here: https://retriever.corgea.io/why.html
2024 · retriever.corgea.io
- 3
Hey HN, I've been working on Hansel [1] (an encrypted personal data store you can query with agents), and there wasn't a good way to use the modern macOS Data Protection Keychain. Electron's safeStorage [2] uses the legacy file-based keychain, which allows other apps/agents to query it with the `security` CLI. Not great when you have a dozen agents running in the background! The Data Protection Keychain is nice because it limits access via code-signing access groups and lets you set access rules like Touch ID and/or password. 1: https://hansel.so/ 2.…
19d ago · github.com
- 4
- 5
This project has been kicking around in my head since I first heard about the webauthn PRF extension in early 2024. I've slowly chipped away at it since, and finally got things to a shareable state over the summer thanks to a very fun parental leave. Headed back to work tomorrow, so I figure there's no time like the present. tldr: A client-held encryption key derived during passkey authentication encrypts all sensitive user data prior to persistence so that only the user is able to decrypt and reuse that data on their device. This allows short-lived, privacy-preserving age proofs to be…
18d ago · loginwithone.com
- 6LL
2020 · github.com
- 7
- 8
- 9TA
2016 · tenta.com
- 10
- 11KE
Keeper is an embeddable secret store (Argon2id, XChaCha20-Poly1305 by default). Four security levels, audit chains, crash-safe rotation. Vault is overkill for most use cases. This is for when you ge paranoid about env and need encrypted local storage that doesn't suck. No security through obscurity, hence, It's still early, so now's the best time to find weird edge cases, race conditions, memory leaks, crypto misuse, anything that breaks. The README has a full security model breakdown if you want to get adversarial.
Apr 2026 · github.com
- 12SE
Hello. I made this project as an experiment in using key cryptography for user identity in a client server model, and for some future peer to peer projects that I am working on. I am looking for feedback, please let me know what you think. Also, Merry Christmas to HN! :-)
2022 · github.com
- 13CS
2021 · github.com
- 14BC
Hi HN, I'm releasing my round one public demo of a new browser security system I've been developing. There's a real Bitcoin private key (worth $20) in plaintext at app.redactsure.com. You can copy it, paste it, delete it, move it around - full control. But you can't see the actual characters or extract them. The challenge: Break the protection and take the Bitcoin. First person wins, challenge ends. Details: - Requires email verification (prevents abuse, no account needed) - 15 minute time limit per session - Currently US only for the demo (latency) - Verify the Bitcoin is real:…
2025 · app.redactsure.com
- 15SH
I have written a passwords/secrets manager for my personal needs. Maybe it solves some of your problems too. It is written in Go and is a self-contained executable for a small web-app: https://github.com/jarmo/secrets-web There is also a CLI version if that is your taste: https://github.com/jarmo/secrets-cli To read about more technical details, look into the core repository at https://github.com/jarmo/secrets Any questions/comments/suggestions are welcome in here or via GitHub pull requests.
2020
- 16IP
Hey HN! I made a service to share passwords easy and secure but never promoted it. It's called instapass.io I noticed that people besides my friends and clients actually started to use, so maybe it will be helpful for you too! You share one-time self-destruct message using one time links and I won't even be able to see what you wrote. How does it work? When you generate a message the client-side makes a random password and use that to encrypt the message. The password is appended as an anchor tag which all modern browsers never send to the server. This way, I don't even know what you shared.…
2019
- 17EP
I've had issues saving bookmarks on my computer since my girlfriend always uses it. I'm talking about engagement ring related bookmarks, birthday plans related bookmarks, etc. My buddy and I built an extension called Hush that allows you to save them behind a password of your choosing. They're encrypted using SHA-256/AES, and you can export/import them to your liking (in case someone accidentally uninstalls the extension). It only operates in private browsing for security reasons. Check it out and let us know what you think! Chrome link:…
2013
- 18BB
2021 · mf327.com
- 19
Your bookmarks. Encrypted. Private. Yours alone
Jun 2026 · osv-it-studio.github.io
- 20KA
Hi HN, I made Keepr, a simple offline CLI password manager for developers who prefer keeping secrets local and working entirely in the terminal. Everything is stored in an encrypted SQLCipher database, protected by a master password. A time-limited session keeps the vault unlocked while you work, so you don’t need to re-enter the password constantly. Keepr never touches the network. It includes commands to add, view, search, update, and delete entries, plus a secure password generator and clipboard support. Technical details: - AES-256 via SQLCipher - PBKDF2-HMAC-SHA256 (1.2M iterations) for…
Nov 2025
- 21
- 22MS
2025 · github.com
- 23SF
I built SecretMemoryLocker (https://secretmemorylocker.com), a file encryption tool that generates keys dynamically from your answers to personal questions instead of using a static master password. This makes offline brute-force attacks much more difficult. Think of it as a password manager that meets mnemonic seed recovery, but without storing any sensitive keys on disk. Why? I kept losing master passwords and wanted a solution that wasn't tied to a single point of failure. I also wanted to create a "digital legacy" that my family could access only under specific conditions. The…
2025 · github.com
- 24SK
2015 · getskds.io
Ranked by how close each launch is in meaning, then by votes. Refine with a description →