Projects sharing features with YubiKey Guide

Ockam is a zero-trust networking framework designed to secure data transit between distributed applications using an identity-based network overlay. It provides the primitives necessary to establish mutually authenticated and end-to-end encrypted connections, removing the reliance on traditional network-layer security. The project is distinguished by its use of attribute-based access control and verifiable credentials to manage trust at scale. It implements cryptographic identity rotation to maintain identity continuity and integrates with hardware-backed key management systems to secure priv

Sui is a blockchain platform featuring an object-centric state model and resource-oriented smart contracts. It utilizes parallel transaction execution to increase network throughput and supports programmable transaction blocks that bundle multiple operations into single atomic units. The platform distinguishes itself with a capability-based access control system and zero-knowledge login mechanisms, enabling users to authenticate via identity providers without seed phrases. It also implements deterministic object addressing to allow predictable state lookups and supports the creation of soulbo

GmSSL is an open-source cryptographic library that implements the Chinese national cryptographic standards SM2, SM3, SM4, SM9, and ZUC as a unified algorithm suite. It provides a comprehensive set of cryptographic primitives including symmetric and asymmetric encryption, digital signatures, hashing, and key exchange, all built around these national standards for government and enterprise security applications. The library distinguishes itself through several integration capabilities. It includes an OpenSSL compatibility layer that maps GmSSL functions to OpenSSL API calls, enabling drop-in re

Flux is a Kubernetes GitOps controller and deployment engine that synchronizes cluster state with configurations stored in a Git repository. It serves as a system for continuous delivery, utilizing a manifest generator to create configuration files from templates and a reconciliation loop to ensure the live environment matches the desired state defined in versioned repositories. The project distinguishes itself through a container image automator that scans registries and updates manifests based on semantic versioning or regular expressions. It incorporates secure configuration deployment via

This project is a comprehensive guide to Git version control standards and best practices. It provides a set of instructions for writing professional commit messages and managing repository history to ensure project maintainability. The documentation covers the standardization of commit messages through specific rules for mood, capitalization, and structural separation of subjects and bodies. It also includes guidelines for composing pull request summaries and cover letters to provide maintainers with necessary technical context and logic. The guide extends to repository security and history

Ungit is a web-based graphical interface and version control client for managing Git repositories. It provides a visual dashboard for performing version control operations, staging changes, and committing files without using a terminal. The project integrates third-party merge utilities to resolve file conflicts and includes a system for signing and verifying the authenticity of code contributions using PGP encryption keys. The interface maintains synchronization with the local filesystem by monitoring directory changes in real time to update the repository state. It interfaces with the unde

GAM is a command-line tool for administering Google Workspace and Cloud Identity. It translates command-line arguments into structured API calls, enabling administrators to manage users, groups, organizational units, and domain settings across a Google Workspace environment. The tool handles authentication through OAuth2 flows, service accounts, and workload identity federation, and supports multi-tenant configurations for managing multiple domains or cloud projects from a single installation. GAM distinguishes itself through its batch processing and automation capabilities. It can process la

This project is a native implementation of the Git version control system for Go applications. It provides a programmable API and a low-level plumbing toolset that allows developers to manage repositories, manipulate object graphs, and perform version control operations without requiring external system binaries or C bindings. The library is distinguished by its flexible storage and network layers, featuring a virtual file system that enables in-memory repository management to bypass disk I/O. It supports pluggable network transports and interface-based storage backends, allowing for custom p

VeraCrypt is a cross-platform disk encryption utility used to create encrypted file containers and secure entire disk partitions. It functions as a tool for full disk encryption and a manager for encrypted volumes, providing a means to protect sensitive data on local disks and removable media across multiple operating systems. The software is distinguished by its support for plausible deniability, allowing the creation of hidden volumes nested within other encrypted volumes to conceal the existence of data. It also implements hardware-based access control, requiring physical security tokens,

SuperTokens Core is an open-source, self-hosted authentication and identity management platform designed for deployment within private infrastructure. It provides a comprehensive suite for managing user accounts, roles, and secure authentication flows, utilizing a modular, recipe-based architecture that allows developers to enable specific security features without modifying the core codebase. The platform distinguishes itself through its robust multi-tenancy capabilities, which allow for the logical or physical isolation of user records and configuration settings across different organizatio

This project is a cross-platform credential management suite designed to store sensitive information in encrypted local databases. It functions as a secure desktop application that provides a unified environment for organizing secrets, generating passwords, and managing multi-factor authentication tokens. By utilizing industry-standard file formats, the application ensures that stored credentials remain secure and interoperable across different operating systems. The software distinguishes itself through deep integration with hardware-backed security and system-level services. It supports phy

Quarkus is a Kubernetes-native Java framework designed for building high-performance, memory-efficient applications. It utilizes ahead-of-time native compilation to transform Java code into standalone, optimized binaries that eliminate the need for a virtual machine, enabling rapid startup and reduced memory consumption. By performing code augmentation during the build phase, it shifts heavy processing tasks away from runtime, ensuring that applications are optimized for cloud-native environments. The framework distinguishes itself through a unified approach to reactive and imperative program

This project is a command-line tool for managing public key infrastructure and digital identities. It provides a comprehensive suite for X.509 certificate lifecycle management, including the generation, signing, renewal, and revocation of certificates and signing requests. The tool distinguishes itself through specialized security capabilities such as binding cryptographic credentials to TPMs and HSMs for hardware-backed identity attestation. It also provides dedicated support for machine identity security, using short-lived SSH certificates and mTLS to secure non-human workloads. Broad capa

FingerprintPay is an Android biometric payment bridge and credential manager that replaces manual password entry with biometric verification for checkout processes in compatible mobile applications. It functions as a tool to authorize payment transactions and automate credential entry through fingerprint verification. The system utilizes hardware-backed security to decrypt stored payment credentials and map biometric identities to encrypted data blobs stored within the device hardware security module. The project covers mobile payment security and automated credential entry by combining hard

andOTP is an open-source multi-factor authentication client for Android. It functions as a time-based and HMAC-based one-time password authenticator for managing two-factor authentication tokens. The application serves as an encrypted vault for authentication secrets, utilizing hardware keystores, passwords, or PINs to secure the account database. It is specifically designed to support automated backups by exporting account databases via system broadcasts for integration with external automation tools. The software covers the management of authentication tokens through QR code scanning and t

Octelium is a zero-trust network access platform and identity-aware proxy designed to secure private HTTP, SSH, and SQL resources. It functions as a secure gateway that validates human and workload identities using OIDC, SAML, and FIDO2 passkeys before granting access to internal applications and SaaS APIs. The system is distinguished by its secretless access broker, which injects credentials—such as API keys, passwords, and AWS Sigv4 signatures—at the gateway level so users can access databases and cloud resources without managing secrets. It further specializes in AI gateway administration,

KeeWeb is a web-based password manager and vault that allows users to open and edit encrypted databases through a browser interface. It functions as a cross-platform tool for managing password vaults using the KeePass database format. The application provides a self-hosted password vault that can be deployed as a single HTML file or via Docker. It integrates with remote storage providers using OAuth to synchronize encrypted database files across multiple devices. The system includes capabilities for secure credential generation, two-factor authentication management through time-based one-tim

Keyguard is a password manager application and secure vault designed for storing and organizing logins, passkeys, and sensitive data. It provides a multi-factor authentication vault that utilizes encrypted offline access to ensure credentials remain available without an internet connection. The application includes a dedicated SSH key manager and agent integration for generating and managing keys to access remote servers. It also features a password security auditor that analyzes vault entries to identify compromised, reused, or weak credentials. The system covers a broad range of security c

gocryptfs is a FUSE-based encrypted filesystem that transparently encrypts and decrypts file contents and filenames on disk. It uses block-level authenticated encryption with AES-GCM or AES-SIV-512, binding each block to its file header and offset for integrity, while obfuscating filenames with EME or AES-SIV wide-block ciphers using per-directory initialization vectors. The system derives all encryption keys and initialization vectors deterministically from a master key using HKDF and SHA256, enabling reproducible ciphertext for reliable backup and synchronization workflows. The project dist

This project is a custom firmware for the Flipper Zero that provides an embedded plugin ecosystem, a hardware pentesting toolkit, and a multi-protocol emulation layer. It modifies the device's operating system to include a Sub-GHz radio suite for expanded frequency range and the ability to build and deploy third-party applications directly onto the hardware. The firmware extends the device's native capabilities through a Sub-GHz radio suite that allows for frequency extension and signal capture beyond factory defaults. It implements specialized emulation for BadUSB and BLE keyboards and inclu

Age is a command-line utility for file encryption that utilizes hybrid cryptography to secure data for multiple recipients. It employs a combination of asymmetric key exchange and symmetric encryption to protect files, supporting access control through public keys, shared passphrases, and hardware-backed identity integration. The tool is designed for memory-efficient operation, utilizing stream-oriented processing to handle large datasets in small, sequential chunks. It features a stanza-based metadata framing system that allows for extensible file headers and supports random-access decryptio

Vault is a centralized secrets management platform designed to secure, store, and control access to sensitive credentials such as API keys, passwords, certificates, and encryption keys. At its core, the system employs a barrier-based cryptographic sealing mechanism that requires an unseal process to decrypt internal storage, ensuring that sensitive data remains protected. It provides identity-based access control to manage granular permissions across distributed infrastructure, effectively centralizing security policies and authentication for both human and machine workloads. What distinguish

AP2 is a framework for autonomous agent commerce designed to facilitate financial transactions between AI agents and merchants. It provides a standardized communication protocol and data models for coordinating catalogs and checkout requests, enabling agents to execute payments independently using digital credentials or traditional payment instruments. The project distinguishes itself through a cryptographic authorization framework that uses signed mandates to delegate limited financial authority to agents. These mandates include strict spending limits, payee restrictions, and temporal bounda

Himalaya is a command line email client and a suite of toolsets for email protocol implementation. It provides a terminal-based interface for managing email accounts using IMAP and SMTP protocols. The project includes a PIM framework and specialized libraries for building personal information management applications that integrate emails, contacts, calendars, and tasks. It features a PGP email encryptor for end-to-end encrypted communication and an email data exporter that extracts messages and metadata into JSON format for use in external scripts. The system covers a broad range of email ma

This project provides a high-performance key-value storage solution for mobile applications, utilizing memory-mapped files to enable rapid read and write operations. It functions as a persistent data layer that integrates directly with the JavaScript runtime to minimize overhead, while supporting reactive state synchronization to ensure interface components update automatically when stored data changes. The storage system distinguishes itself through its ability to manage multiple independent database instances, which organizes data by module and prevents collisions between application compon

Nostr is a decentralized social protocol and censorship-resistant messaging standard. It operates as a distributed event relay network where user identities are defined by public-key cryptography rather than centralized account databases. The protocol enables the exchange of cryptographically signed messages across a network of independent relays. This system allows for the broadcasting of signed notes to multiple servers to ensure content availability and permanence, while using public-key pairs to prove authorship and authenticity without a central registry. The system covers distributed c

hashsigs-py is a hash-based signature library for Python used to generate and verify one-time digital signatures. It employs hash chains and seed-based key derivation to authenticate data and ensure message integrity. The library includes a high-performance compiled cryptography backend to accelerate signature computation and processing. For compatibility, it maintains a pure Python fallback implementation to ensure functionality when the compiled backend is unavailable. The project provides tools for digital key pair management, allowing for the deterministic generation of public and privat