Skip to content
md ~/projects/crypto-toolkit
Project archive

2025Live

Crypto Toolkit

  • C#
  • ASP.NET Core MVC
  • JavaScript
  • Web Crypto API
  • xUnit
  • Docker
  • Render
View on GitHubTry it live

Overview

A cryptography toolkit that runs in the browser: password-based AES-GCM encryption, RSA hybrid encryption, ECDSA signatures and SHA-2/HMAC. Data never leaves the device.

01 · Problem

My final project for an Information Security and Cryptography course encrypted on the server with a key and IV hard-coded in the source. Since the repository was public, anyone could decrypt everything, and nothing detected changes to the ciphertext.

02 · Solution

I rewrote it so that all cryptography runs in the browser with the Web Crypto API: AES-256-GCM with a PBKDF2-derived key, RSA-OAEP hybrid encryption, ECDSA P-256 signatures, SHA-2 and HMAC, in versioned packages whose headers are authenticated too. ASP.NET Core only serves the pages, and the Content Security Policy stops the page from sending data anywhere.

03 · Outcome

A live, bilingual site with four tools that also works on phones. 96 automated tests (including NIST and RFC 4231 vectors) plus live measurements caught an empty 429 page and a rate limit that did not work behind Cloudflare before release.