Open-source alternatives to Mbedtls

phpseclib is a pure-PHP cryptographic library that provides a comprehensive suite of cryptographic operations entirely without requiring compiled C extensions. At its core, it implements arbitrary-precision integer arithmetic for big-number math, ASN.1 DER encoding and decoding for working with cryptographic data structures, and a full set of pure-PHP cryptographic primitives. The library is designed to operate on PHP 5.6 and above, automatically detecting and using native extensions like GMP or BCMath when available, but falling back to its own pure-PHP implementations when they are not. The

F Prime is a component-based framework designed for the development and deployment of embedded and spaceflight software. It provides a modular architecture that decouples software logic from communication interfaces, allowing developers to define system structures through a domain-specific modeling language. This model-based approach enables automated code generation, ensuring consistency across complex system topologies while maintaining strict interface contracts between software modules. The framework distinguishes itself through its integrated build system and ground data operations suite

Crypto++ is a comprehensive C++ cryptographic library that implements a broad range of algorithms for symmetric and asymmetric encryption, hashing, and digital signatures. It is designed as a portable toolkit, usable across different operating systems without modification. The library distinguishes itself through its architecture: cryptographic parameters such as key size and mode are configured at compile time via C++ templates, eliminating runtime overhead. Algorithms are registered in a static factory for runtime lookup, while data processing follows a pipeline model of composable sources,

edk2 is a development project for creating system firmware that complies with the UEFI specification. It provides the necessary infrastructure to initialize hardware platforms and boot operating systems across multiple CPU architectures. The project utilizes a modular firmware architecture that decouples high-level management protocols from physical transport layers. It implements critical security features, including a measured boot chain, cryptographic primitives for image authentication, and support for Trusted Platform Module hardware and software implementations. Its capability surface

NuttX is a POSIX-compliant real-time operating system designed for microcontrollers ranging from 8-bit to 64-bit architectures. It provides a deterministic execution environment with a real-time task scheduler and a POSIX embedded kernel to ensure portable code execution across diverse hardware targets. The project distinguishes itself through a comprehensive hardware abstraction layer that provides standardized drivers for I2C, SPI, CAN, and USB across various semiconductor chipsets. It also features an embedded networking stack supporting TCP, UDP, IPv4, and IPv6, alongside industrial proto

This project is a Python cryptography library that provides a collection of cryptographic primitives and high-level recipes for implementing secure encryption and authentication. It functions as a symmetric encryption toolkit and a cryptographic hash provider, offering both a low-level cryptographic interface for building custom protocols and high-level tools for securing data. The library covers a broad range of security capabilities, including symmetric data encryption, the derivation of cryptographic keys from passwords or secret values, and data integrity verification through the generati

Libsodium is a portable, C-based cryptographic library that provides a collection of modern primitives for encryption, decryption, digital signatures, password hashing, and secure key exchange. It is designed to facilitate secure communication and data integrity across diverse hardware architectures and operating systems. The library distinguishes itself by utilizing constant-time primitive execution to prevent side-channel attacks and employing memory-hard algorithms to increase the difficulty of brute-force password attacks. It abstracts complex mathematical operations into simplified inter

sjcl is a JavaScript cryptography library providing a collection of primitives for encryption, hashing, and encoding within a web browser. It functions as an AES symmetric encryption tool, a cryptographic hashing library, and a Base32 data encoder. The project provides implementations for the Advanced Encryption Standard to secure data through symmetric key encryption and decryption. It also enables the generation of fixed-length data fingerprints to verify information integrity and authenticity. The library covers a broader range of security capabilities, including client-side data hashing,

This is an educational resource that provides a comprehensive guide to blockchain and distributed ledger technologies, covering everything from fundamental concepts to practical deployment. The guide systematically explains the core architecture of blockchain systems, including consensus-based distributed ledgers, cryptographic hash chains, Merkle trees, and smart contract execution engines, while also detailing permissioned channel architectures and modular service platforms for enterprise use. The resource distinguishes itself by offering a dual-track learning path that serves both non-tech

This project is a comprehensive computer networking textbook and instructional resource. It serves as a technical guide for the design and implementation of network layers, protocols, and hardware architecture, covering the spectrum from physical links to application-layer protocols. The content provides a detailed study of standards for congestion control, reliable data delivery, and internetwork routing. It includes specialized technical material on network security, public-key infrastructure, and the operation of modern cloud infrastructure and data centers. The material covers a broad ra

Lancet is a comprehensive extension of the Go standard library, providing a collection of reusable functions and data structures designed to reduce boilerplate code in applications. It serves as a general-purpose toolkit across multiple domains, including concurrency, security, networking, and functional logic. The project distinguishes itself through specialized toolkits for Go concurrency, such as keyed locking and channel-based stream processing, and a dedicated functional programming kit that supports currying and function composition. It also includes a dedicated cryptography library imp

crypto-js is a JavaScript cryptography library providing a collection of standard cryptographic algorithms and data transformation tools. It functions as a symmetric encryption toolset, a cryptographic hash implementation, and a password derivation tool for the JavaScript environment. The library enables the protection of sensitive data through symmetric encryption and the production of fixed-size data digests to verify integrity. It includes utilities for converting user passwords into secure cryptographic keys and a data format converter for translating information between Base64, Hex, and

CryptoSwift is a cryptography library implemented entirely in the Swift programming language. It provides a collection of standard cryptographic algorithms for encryption, decryption, and hashing without relying on native C libraries or system frameworks. The library supports symmetric and asymmetric encryption, including RSA key generation and signature management. It features authenticated encryption schemes and the ability to generate cryptographic digests for data integrity verification. The toolset covers message authentication codes, secure key derivation from passwords, and data paddi

This project is a command-line tool for managing public key infrastructure and digital identities. It provides a comprehensive suite for X.509 certificate lifecycle management, including the generation, signing, renewal, and revocation of certificates and signing requests. The tool distinguishes itself through specialized security capabilities such as binding cryptographic credentials to TPMs and HSMs for hardware-backed identity attestation. It also provides dedicated support for machine identity security, using short-lived SSH certificates and mTLS to secure non-human workloads. Broad capa

grpc-rust is a native gRPC framework for Rust designed for building high-performance remote procedure call clients and servers. It provides an asynchronous communication stack and a protocol buffers implementation for encoding, decoding, and generating type-safe code from service definitions. The project enables the implementation of unary and bi-directional data streaming over the HTTP/2 protocol. It includes specialized support for gRPC-Web integration, allowing browser-based clients to communicate with services through protocol translation. The infrastructure covers a broad range of distr

Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o

Node.js is an open-source, cross-platform JavaScript runtime environment built on the V8 engine, designed for executing JavaScript code outside a web browser. It operates as a server-side JavaScript platform with an event-driven, non-blocking I/O architecture that enables building scalable network applications and web servers. The runtime integrates the CommonJS module system for synchronous module loading and the npm ecosystem for sharing and reusing packages. The platform provides comprehensive capabilities for web server development, including creating HTTP and HTTPS servers, managing HTTP

This project provides a collection of practical implementations and code references for establishing secure network communications using transport layer security protocols. It serves as a guide for developers to implement public key infrastructure and enforce encryption standards within client and server applications. The repository focuses on cryptographic certificate management, including the generation of public and private key pairs and the creation of self-signed certificates for local testing environments. It covers the configuration of secure web servers, offering methods to harden ser

Sprig is a comprehensive library of helper functions designed to extend the Go text template engine. It provides a wide array of custom functions that can be injected into the engine to enable complex data manipulation and logic directly within templates. The project offers specialized capabilities for cryptography, including the generation of private keys, X.509 certificates, and secure password hashes. It also includes advanced logic extensions for semantic versioning comparison, ternary evaluations, and the resolution of environment variables from the host operating system. The library co

This project is an educational textbook and technical handbook focused on the practical implementation of cryptographic algorithms for software development. It serves as a comprehensive resource for engineers seeking to apply mathematical primitives to secure data storage and network communications. The material covers the application of symmetric and asymmetric ciphers, digital signature verification, and key derivation functions. It details the construction of secure protocols by combining fundamental building blocks such as hashes and message authentication codes to ensure data privacy, in

c3c is the compiler for the C3 programming language, transforming source code into executable binaries, static libraries, or dynamic libraries using an LLVM backend. It implements a system based on result-based error handling, scoped memory pooling, and a semantic macro system. The compiler provides first-class support for hardware-backed SIMD vectors that map directly to processor instructions and enables runtime polymorphism through interface-based dynamic dispatch. The project covers a broad set of low-level capabilities, including manual and pooled memory management, inline assembly inte

Soketi is a high-performance WebSocket server designed to facilitate real-time bidirectional communication and event broadcasting. It functions as a multi-tenant gateway that implements the Pusher protocol, allowing existing client-side applications to integrate without modifying their underlying logic. The server acts as a distributed event broker, synchronizing messages across multiple instances to support horizontal scalability in cloud-native environments. The platform distinguishes itself through its focus on secure, isolated multi-tenant hosting and robust traffic management. It enforce

s2n is a C-based security library and TLS protocol implementation that serves as a secure network transport layer. It provides a modular cryptographic backend interface to encrypt data streams, manage handshakes, and handle mutual authentication between peers. The project focuses on post-quantum cryptography, integrating quantum-resistant key exchange and digital signatures to protect connections against future computing threats. It distinguishes itself through security hardening measures, such as memory-locked secret storage to prevent keys from being swapped to disk and timing-attack mitiga

pysheeet is a technical reference library providing a curated collection of code snippets and implementation patterns for advanced Python development, system integration, and high-performance computing. It serves as a comprehensive guide for implementing low-level network programming, native C extensions, and asynchronous and concurrent programming. The project provides specialized frameworks for the development and deployment of large language models, including tools for distributed GPU inference and high-performance serving. It also includes detailed patterns for high-performance computing

This project is a freestanding kernel written in Rust that boots on x86 hardware without a standard library. It serves as a low-level system implementation focusing on the creation of a bare metal operating system. The system implements a bootable disk image toolchain that transforms source code into binaries compatible with a bootloader. It features a custom memory allocator for dynamic memory management and an x86 kernel implementation that includes paging, interrupt handling, and VGA text mode. The project covers several core capability areas, including low-level memory management through

Infisical is a centralized secrets management platform designed to store, synchronize, and control access to sensitive credentials and configuration data across distributed development, staging, and production environments. It employs client-side encryption to ensure that secrets remain unreadable to the underlying storage infrastructure, while providing a hierarchical permission model to govern both user and machine access. The platform distinguishes itself through dynamic credential provisioning, which generates short-lived access tokens that are automatically revoked after use. It supports

Proxyman is a cross-platform HTTP debugging proxy that captures, inspects, and modifies HTTP, HTTPS, and WebSocket traffic. It functions as a man-in-the-middle proxy, decrypting SSL/TLS traffic to allow real-time inspection and modification of encrypted requests and responses. The tool is designed for debugging web and mobile applications, with capabilities for API mocking and simulation, scriptable traffic modification, and team collaboration on network logs. What distinguishes Proxyman is its deep integration with mobile and cross-platform development workflows. It provides automated certif