Life & fun · alternatives · 2026

24 alternatives to Storing Private Keys in the Browser Securely

So the main purpose here is to show _a_ way that session-token theft can be mitigated. Clearly, this isn't NSA proof or something you'd use to secure a BL5 containment facility, but to prevent session-jacking; if feels like it could help a lot, and would be pretty quick and easy to roll out if an IDP wanted to implement it.

This project demonstrates a method for mitigating session-token theft by securely storing private keys in web browsers. It's designed for identity providers seeking to prevent session-jacking attacks. While not… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. Storing Private Keys in the Browser Securely launched in 2024; newer entries below may have overtaken it.

1DB
Device-Bound Session Tokens in JavaScript▲23
Google’s recent announcement of a proposed ‘Device Bound Session Credentials’ feature[1] for Chrome reminded me of a project we worked on last year at my company. We focus on fraud prevention at signup and login (preventing multi-accounting and account theft), but some customers were concerned about post-login security and asked us to add a session hijacking prevention feature to our fraud prevention API. In the end, we decided to just implement a solution in Javascript. We call it session-lock, and it can be used today across all browsers[2] and, theoretically, native mobile apps. For a…
2024 · session-lock.keyri.com · its alternatives →
2
Retriever – Securely share secrets over the internet▲193
Retriever (https://retriever.corgea.io/), an open-source research project to help users receive secrets and sensitive information without needing a server in the middle. It works by using Public-key cryptography to coordinate the message sharing between the two devices. Read more on why we built it here: https://retriever.corgea.io/why.html
2024 · retriever.corgea.io · its alternatives →
3
WebSession, a Secure Replacement for Cookies▲182
A protocol for secure browser sessions on the World Wide Web
2023 · websession.dev · its alternatives →
4
macOS data protection keychain for Electron apps▲24
Hey HN, I've been working on Hansel [1] (an encrypted personal data store you can query with agents), and there wasn't a good way to use the modern macOS Data Protection Keychain. Electron's safeStorage [2] uses the legacy file-based keychain, which allows other apps/agents to query it with the `security` CLI. Not great when you have a dozen agents running in the background! The Data Protection Keychain is nice because it limits access via code-signing access groups and lets you set access rules like Touch ID and/or password. 1: https://hansel.so/ 2.…
Aug 2026 · github.com · its alternatives →
5
AxKeyStore▲31
Hi HN, I built AxKeyStore, an open-source CLI tool for managing secrets that uses your own private GitHub repository as encrypted storage. The idea is simple: → All encryption happens locally. → Secrets are stored as encrypted blobs in your private repo. → GitHub is treated as untrusted storage. → No plaintext secrets ever leave your machine. → No plaintext secrets are stored on disk. Most secret managers either require a hosted backend, a self-hosted server, or trusting a SaaS provider. I wanted something that: → Requires zero infrastructure → Uses tooling developers already have → Keeps…
Feb 2026 · github.com · its alternatives →
6
Secur3▲77
First decentralized 2FA solution for self-custodial wallets
2022 · secur3.xyz · its alternatives →
7
Securely Handle Encryption Keys in Go▲119
Software sandbox for storage of sensitive information in memory. - awnumar/memguard
2017 · github.com · its alternatives →
8
Anonymous age verification with passkey-powered encryption▲45
This project has been kicking around in my head since I first heard about the webauthn PRF extension in early 2024. I've slowly chipped away at it since, and finally got things to a shareable state over the summer thanks to a very fun parental leave. Headed back to work tomorrow, so I figure there's no time like the present. tldr: A client-held encryption key derived during passkey authentication encrypts all sensitive user data prior to persistence so that only the user is able to decrypt and reuse that data on their device. This allows short-lived, privacy-preserving age proofs to be…
Aug 2026 · loginwithone.com · its alternatives →
9
PassLock: Password Manager▲103
Distributed password manager & only you can access
2023 · apps.apple.com · its alternatives →
10
Search Encrypt▲69
The Privacy Based Search Engine
2017 · its alternatives →
11
SecretCrypt – Keeping secrets in plain sight▲75
2016 · zemanta.github.io · its alternatives →
12
Keeper – embedded secret store for Go (help me break it)▲64
Keeper is an embeddable secret store (Argon2id, XChaCha20-Poly1305 by default). Four security levels, audit chains, crash-safe rotation. Vault is overkill for most use cases. This is for when you ge paranoid about env and need encrypted local storage that doesn't suck. No security through obscurity, hence, It's still early, so now's the best time to find weird edge cases, race conditions, memory leaks, crypto misuse, anything that breaks. The README has a full security model breakdown if you want to get adversarial.
Apr 2026 · github.com · its alternatives →
13SH
Self-hosted and self-contained web app password manager written in Go▲40
I have written a passwords/secrets manager for my personal needs. Maybe it solves some of your problems too. It is written in Go and is a self-contained executable for a small web-app: https://github.com/jarmo/secrets-web There is also a CLI version if that is your taste: https://github.com/jarmo/secrets-cli To read about more technical details, look into the core repository at https://github.com/jarmo/secrets Any questions/comments/suggestions are welcome in here or via GitHub pull requests.
2020 · its alternatives →
14
Cocert: split your private keys securely amongst untrusted network▲37
Split and distribute your private keys securely amongst untrusted network - Dentrax/cocert
2021 · github.com · its alternatives →
15
Secure end-to-end client sessions and API calls using crypto key pairs▲9
Hello. I made this project as an experiment in using key cryptography for user identity in a client server model, and for some future peer to peer projects that I am working on. I am looking for feedback, please let me know what you think. Also, Merry Christmas to HN! :-)
2022 · github.com · its alternatives →
16
html-vault – create self-contained HTML for password protected content▲55
Generates self-contained HTML files protecting secret text content. - dividuum/html-vault
2020 · github.com · its alternatives →
17
Bitcoin Challenge. Try to steal a plain text private key you can use▲14
Hi HN, I'm releasing my round one public demo of a new browser security system I've been developing. There's a real Bitcoin private key (worth $20) in plaintext at app.redactsure.com. You can copy it, paste it, delete it, move it around - full control. But you can't see the actual characters or extract them. The challenge: Break the protection and take the Bitcoin. First person wins, challenge ends. Details: - Requires email verification (prevents abuse, no account needed) - 15 minute time limit per session - Currently US only for the demo (latency) - Verify the Bitcoin is real:…
2025 · app.redactsure.com · its alternatives →
18
Minimal NIST/OWASP-compliant auth implementation for Cloudflare Workers▲33
This is an educational reference implementation showing how to build reasonably secure, standards-compliant authentication from first principles on Cloudflare Workers. Stack: Hono, Turso (libSQL), PBKDF2-SHA384 + normalization + common-password checks, JWT access + refresh tokens with revocation support, HTTP-only SameSite cookies, device tracking. It's deliberately minimal — no OAuth, no passkeys, no magic links, no rate limiting — because the goal is clarity and auditability. I wrote it mainly to deeply understand edge-runtime auth constraints and to have a clean Apache-2.0 example that…
Feb 2026 · github.com · its alternatives →
19
PageLock▲6
Hey HN! I'm the creator of PageLock. I built this because I kept running into situations where I needed to share sensitive URLs (private docs, beta links, etc.) but didn't want to trust a third-party service with the data. How it works: - Client-side AES-256-GCM encryption using Web Crypto API - Your password and original URL are encrypted in the browser before storage - Zero-knowledge architecture - None can decrypt links without the password - except someone manages to break AES-256 :0 - Pure frontend (React + TypeScript), no backend database The key insight: by doing encryption…
Nov 2025 · pagelock.top · its alternatives →
20
My Trick for Securing Websites Without a DB▲13
Discover our strategy for easily securing applications without the overhead of using a datastore, setting up users, and facilitating authentication.
2016 · arcweb.co · its alternatives →
21EP
Encrypted private bookmarks for incognito mode on Firefox and Chrome▲9
I've had issues saving bookmarks on my computer since my girlfriend always uses it. I'm talking about engagement ring related bookmarks, birthday plans related bookmarks, etc. My buddy and I built an extension called Hush that allows you to save them behind a password of your choosing. They're encrypted using SHA-256/AES, and you can export/import them to your liking (in case someone accidentally uninstalls the extension). It only operates in private browsing for security reasons. Check it out and let us know what you think! Chrome link:…
2013 · its alternatives →
22
SecretDrop▲8
Hey everyone, English is not my native language. This post was polished with AI, but the content is mine. I run a small dev agency in Germany. Every week someone shares database credentials, API keys, or a .env file via Slack or email. Not because they don’t care: because there’s no frictionless alternative. Vault setups are heavy. Enterprise tools are expensive. I just needed: upload → share link → done. But encrypted before leaving the browser. So I built SecretDrop.dev. What it does Files encrypted client-side (AES-256-GCM, PBKDF2 600k iterations) Built entirely on WebCrypto No…
Feb 2026 · secretdrop.dev · its alternatives →
23
Frozen Security▲4
The core problem I kept running into with hardware wallets: the private key exists as a persistent digital object inside a chip. It’s protected — but it exists. That’s the vulnerability. Protection fails; existence is structural. I built a different model. The private key is encoded as a geometric hole pattern in a titanium plate. A signing terminal reads the plate optically, derives the key transiently in volatile memory, signs the transaction, and discards everything. The plate doesn’t change. Nothing is stored. A few implementation details that might interest people here: The signing…
Feb 2026 · frozensecurity.com · its alternatives →
24
Browser-Based Private Cloud, Remote Access and Webcam Security▲12
Turn any Windows PC into a Secure, Private Cloud. Access your Desktop, Files, Webcams, and Data from any Web Browser. Stream, Share and Detect Motion
2021 · mf327.com · its alternatives →

Also compare

Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →