Storing Private Keys in the Browser Securely

In plain words

This project demonstrates a method for mitigating session-token theft by securely storing private keys in web browsers. It's designed for identity providers seeking to prevent session-jacking attacks. While not intended for extreme security scenarios, the approach offers practical protection against common threats and claims to be relatively straightforward for developers to implement.

written from the facts on this page · September 2026

From the sources

Protect SessionTokens with Private Keys - In The Browser - JWally/BrowserPrivateKeyDemo

• DB
  Device-Bound Session Tokens in JavaScript2024 · session-lock.keyri.com · ▲23

  Google’s recent announcement of a proposed ‘Device Bound Session Credentials’ feature[1] for Chrome reminded me of a project we worked on last year at my company. We focus on fraud prevention at signup and login (preventing multi-accounting and account theft), but some customers were concerned about post-login security and asked us to add a session hijacking prevention feature to our fraud prevention API. In the end, we decided to just implement a solution in Javascript. We call it session-lock, and it can be used today across all browsers[2] and, theoretically, native mobile apps. For a…

• 
  Retriever – Securely share secrets over the internet2024 · retriever.corgea.io · ▲193

  Retriever (https://retriever.corgea.io/), an open-source research project to help users receive secrets and sensitive information without needing a server in the middle. It works by using Public-key cryptography to coordinate the message sharing between the two devices. Read more on why we built it here: https://retriever.corgea.io/why.html

• 
  macOS data protection keychain for Electron appsAug 2026 · github.com · ▲24

  Hey HN, I've been working on Hansel [1] (an encrypted personal data store you can query with agents), and there wasn't a good way to use the modern macOS Data Protection Keychain. Electron's safeStorage [2] uses the legacy file-based keychain, which allows other apps/agents to query it with the `security` CLI. Not great when you have a dozen agents running in the background! The Data Protection Keychain is nice because it limits access via code-signing access groups and lets you set access rules like Touch ID and/or password. 1: https://hansel.so/ 2.…

• 
  AxKeyStoreFeb 2026 · github.com · ▲31

  Hi HN, I built AxKeyStore, an open-source CLI tool for managing secrets that uses your own private GitHub repository as encrypted storage. The idea is simple: → All encryption happens locally. → Secrets are stored as encrypted blobs in your private repo. → GitHub is treated as untrusted storage. → No plaintext secrets ever leave your machine. → No plaintext secrets are stored on disk. Most secret managers either require a hosted backend, a self-hosted server, or trusting a SaaS provider. I wanted something that: → Requires zero infrastructure → Uses tooling developers already have → Keeps…

• 
  Secur32022 · secur3.xyz · ▲77

  First decentralized 2FA solution for self-custodial wallets

• 
  Anonymous age verification with passkey-powered encryptionAug 2026 · loginwithone.com · ▲45

  This project has been kicking around in my head since I first heard about the webauthn PRF extension in early 2024. I've slowly chipped away at it since, and finally got things to a shareable state over the summer thanks to a very fun parental leave. Headed back to work tomorrow, so I figure there's no time like the present. tldr: A client-held encryption key derived during passkey authentication encrypts all sensitive user data prior to persistence so that only the user is able to decrypt and reuse that data on their device. This allows short-lived, privacy-preserving age proofs to be…

• 
  SimCity, but with Permits▲911

  A free city-building game in your browser. You are the mayor. You know what the city needs. Now get it past the zoning board, the neighbors, the appeals court and the next election.

  Life & fun · 2d ago · permit.petercai.com

• IV
  I've been paying for a rural Tanzanian's education for 10 years▲778

  Life & fun · 14d ago · tanzaniaeducationproject.org

• 
  Bigwords.page – Turn any screen into a sign. The URL is the app▲728

  Turn a phone, tablet or TV into a sign. Type a message and it fills the screen: welcome signs, timers, Wi-Fi passwords and more. No app, no account, free.

  Life & fun · 15d ago · bigwords.page

• 
  Guitoro, a virtual guitar you strum with your keyboard▲573

  Play a free virtual guitar online with your keyboard or by touch. Slow songs down and see every chord, string and strum. Acoustic, classic, electric and bass.

  Life & fun · 8d ago · guitoro.com

• 
  See *almost* any carriers phone settings▲432

  Carrier settings from iPhone, Pixel and Galaxy firmware, decoded and compared: APNs, VoLTE, 5G and Wi-Fi Calling per carrier, and what each build changed.

  Life & fun · 13d ago · carrierexplode.com

• 
  The whole Solar System and every tracked satellite, live in the browser▲407

  Life & fun · 22d ago · space.bl2.net

• 
  Supabase▲2,325

  The Postgres developer platform is now generally available

  Dev tools · 2024 · supabase.com

• 
  Cal.com Platform▲1,601

  Build your pixel-perfect booking experience with Atoms

  Dev tools · 2024 · cal.com

• 
  PaddleBoat▲1,162

  Perfect your sales pitch with realistic AI roleplays

  AI · 2024 · padboat.com

• 
  deco.cx 2.0▲1,078

  Build web apps 10x faster with Deno, JSX, TS & Tailwind

  Dev tools · 2024 · decocms.com

• 
  IXORD AI▲955

  Navigate tasks, ignite creativity

  AI · 2024

• 
  Assista AI▲949

  A central nervous system for all your productivity apps

  AI · 2024 · getassista.com