Is there any existing website/code that can be used so that the user can do the following all within the browser and without transmitting raw text to any server?

  • Paste in public key
  • Paste in raw text (FYI it's about 40 characters long)
  • Copy the resulting encrypted text?

The ideal for me would even be that the website accepts the public key as part of the URL, to save the user a step. Essentially I want a safe and simple way for users to provide me "secret" information via my public key.


closed as off-topic by e-sushi Jun 14 '17 at 19:50

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • $\begingroup$ If the users already know your public key, why not just have them encrypt their data with that public key and send the resulting ciphertext to you? There're lots of issues to consider, like how the users actually know that it's your public key (did they already get it?; how do they know it's actually yours and not an attacker's?) and efficiency (public key encryption is slow; asymmetrically encrypting a symmetric key can help), but for the basic conceptual problem where they already have your public key, it seems like you're already good-to-go. $\endgroup$ – Nat Jun 14 '17 at 6:03
  • $\begingroup$ Just to note it, there's nothing special or protected about the URL, so you can't really use it as a special mechanism to safely transmit data. Whatever solution you come up with, there's no security reason to shove any part of the information into the URL. $\endgroup$ – Nat Jun 14 '17 at 6:11
  • $\begingroup$ Asking for software recommendations is off-topic here. Anyway, here is a random elliptic curve JS library: github.com/indutny/elliptic More exist. $\endgroup$ – Elias Jun 14 '17 at 7:40

Let me just point out the usual problem with in-browser encryption:

The code that does the encryption is downloaded from the server. Therefore a malicious server can easily send you code which also allows it to access the data.

If you trust the server anyway people can just send you plaintext via HTTPS.


Not the answer you're looking for? Browse other questions tagged or ask your own question.