Open-source alternatives to SEAL

This project is a comprehensive zero-knowledge security suite designed for enterprise credential management, secrets orchestration, and password management. It provides a secure, end-to-end encrypted vault that allows users to store, synchronize, and manage sensitive information, including passwords, passkeys, and infrastructure secrets, across desktop, mobile, and browser environments. The platform distinguishes itself through a strict zero-knowledge architecture where all encryption and decryption occur locally on the client, ensuring that plaintext data remains inaccessible to the server.

VeraCrypt is a cross-platform disk encryption utility used to create encrypted file containers and secure entire disk partitions. It functions as a tool for full disk encryption and a manager for encrypted volumes, providing a means to protect sensitive data on local disks and removable media across multiple operating systems. The software is distinguished by its support for plausible deniability, allowing the creation of hidden volumes nested within other encrypted volumes to conceal the existence of data. It also implements hardware-based access control, requiring physical security tokens,

Kopia is a backup utility designed to create encrypted, deduplicated, and compressed snapshots of files and directories. It functions as a client-side tool that secures data locally before transmitting it to various storage targets, ensuring that sensitive information remains protected throughout the backup process. The system utilizes content-addressable block storage and metadata-driven versioning to identify and remove redundant data across multiple snapshots. By employing a pluggable storage abstraction layer, it supports a wide range of local, network, and cloud-based storage providers,

Ockam is an end-to-end encryption framework and distributed identity provider designed to establish secure communication between applications and devices. It provides a secure network overlay that utilizes cryptographic identities and attribute-based access control to implement zero trust network access. The project distinguishes itself through metadata-driven multi-hop routing and a pluggable transport layer, allowing encrypted traffic to move across diverse network topologies without requiring virtual IP overlays. It specifically enables secure tunneling for legacy applications by wrapping

go-ibax is a blockchain protocol platform and decentralized application infrastructure used to deploy networks with custom governance and token economics. It provides a foundation for building decentralized applications through a framework that integrates identity management and on-chain data storage. The project features a multilingual virtual machine capable of executing smart contracts written in Go, Rust, and Solidity. It implements a sharded blockchain network to increase throughput and a privacy layer utilizing zero-knowledge proofs and homomorphic encryption to anonymize transaction da

Upspin is a decentralized naming and storage system that provides an end-to-end encrypted file system. It assigns every user a unique identity and organizes files within a global, permissioned namespace where data is encrypted on the client before transmission. The system separates identity resolution from data storage using a public-key identity provider and a key-server architecture. This allows for decentralized identity management and the resolution of usernames to specific directory and storage server addresses. The project includes a hierarchical access control system that manages read

Joplin is an open-source, cross-platform note-taking application designed for secure, private knowledge management. It functions as a local-first productivity platform, maintaining a complete relational database on the user's device to ensure offline availability and high-performance data retrieval. The application prioritizes data sovereignty by implementing an end-to-end encryption layer, which secures all information locally with a master key before any synchronization occurs. The platform distinguishes itself through a delta-based synchronization engine that transmits only specific file c

This project provides a comprehensive, self-hosted platform for zero-knowledge credential management and enterprise secrets orchestration. It functions as a secure vault that ensures all encryption and decryption processes occur exclusively on the client side, preventing the server from ever accessing plaintext data. By combining identity federation with robust access controls, the system enables organizations to centralize the management of passwords, passkeys, and sensitive infrastructure credentials. The platform distinguishes itself through its focus on both human-centric security and aut

Signal-Desktop is a cross-platform messaging application that provides end-to-end encrypted communication. It implements the Signal Protocol to secure messages and voice calls, ensuring that only intended recipients can access content. The application manages asynchronous key exchange and session initialization to maintain secure communication channels between parties who are not online simultaneously. The project distinguishes itself through advanced cryptographic protections, including hybrid post-quantum security that combines classical elliptic curve cryptography with lattice-based algori

Deepface is a comprehensive deep learning library for facial recognition and demographic analysis. It provides a modular pipeline that handles the entire lifecycle of facial processing, including detection, geometric alignment, and the transformation of facial images into high-dimensional numerical vector embeddings for identity verification and similarity comparison. The library distinguishes itself through a model ensemble approach, which combines predictions from multiple pre-trained neural networks to improve classification accuracy and reduce bias. It also integrates advanced security fe

This is a secure peer-to-peer file sharing tool that transfers data directly between devices using end-to-end encryption and ephemeral session codes. Files are split into fixed-size chunks with individual integrity hashes, allowing interrupted transfers to resume from the last verified chunk without starting over. All transferred data stays solely in RAM during transit, never written to persistent storage on either peer or any intermediate relay. Beyond file transfer, the tool also provides real-time instant messaging and live screen sharing over the same peer-to-peer connections. Each sessio

Linsa.io is an end-to-end encrypted cloud storage service and zero-knowledge data vault. It functions as a private content sharing platform that encrypts files and data on the client side, ensuring only the owner can access the stored content. The project employs a local-first approach, processing data updates and encryption on the local device before syncing encrypted blobs to a remote persistence layer. It uses a zero-knowledge architecture where the service provider cannot access decryption keys or view the plaintext content of stored files. The platform provides capabilities for private

OnionShare is a privacy-focused data transfer tool and onion service host. It enables the anonymous sharing of files and the hosting of websites by creating temporary hidden services on the Tor network. The software functions as a peer-to-peer system that moves data directly between endpoints without utilizing central third-party servers. It provides capabilities for anonymous file sharing, website hosting, and encrypted peer-to-peer chat, ensuring the identities and IP addresses of participants remain hidden. Communication is secured through end-to-end encryption and Tor-based onion routing

Piknik is an encrypted clipboard relay and multiplexer that coordinates the sharing of text, binary data, and shell content across multiple network hosts. It utilizes a centralized relay architecture to manage secure client connections, providing an end-to-end encrypted system for synchronizing session state and data streams. The project distinguishes itself through the use of multi-stage key derivation and API key access control to secure remote shell access. It employs end-to-end encryption and digital signatures to protect relayed content, ensuring that data is encrypted at the source befo

flutter-webrtc is a real-time communication SDK and plugin for the Flutter framework. It provides a set of tools for establishing peer-to-peer media connections and low-latency data exchange across mobile, desktop, and web environments. The project enables the creation of applications with live audio and video calling, real-time media streaming, and peer-to-peer data channels for sending encrypted arbitrary data packets without a central server. It supports secure media communication through end-to-end encryption for audio, video, and data streams. The SDK covers broad capabilities including

n2n is a peer-to-peer VPN that creates an encrypted mesh network by establishing layer 2 overlay networks. It uses UDP tunneling to connect remote computers into a shared virtual local area network, allowing devices to communicate as if they were on the same physical Ethernet switch. The system utilizes a centralized signaling registry and federated coordination nodes to facilitate peer discovery and node registration. It implements NAT traversal through UDP hole punching and UPnP port mapping, while using supernode relay routing to ensure connectivity when symmetric NATs prevent direct peer-

OpenThread is an open-source implementation of the Thread networking protocol stack. It provides a standard-compliant IPv6 mesh networking stack, integrating 6LoWPAN and IEEE 802.15.4 to enable secure, internet-connected communication for low-power wireless devices in smart home and industrial automation environments. The project includes a Thread Border Router, which acts as a networking gateway bridging low-power mesh networks to external IP networks such as Wi-Fi or Ethernet. It is designed for energy efficiency, featuring a low-power wireless mesh implementation that allows battery-operat

CJDNS is a peer-to-peer VPN and cryptographic network overlay that implements an encrypted IPv6 mesh network. It functions as a distributed hash table router, utilizing a non-hierarchical XOR metric to route traffic across nodes without relying on a central authority or registry. The project distinguishes itself by tying network identity to cryptographic ownership, deriving unique IPv6 addresses from public keys. It ensures secure peer connectivity across NAT boundaries using public-key authentication, end-to-end packet encryption, and a handshake protocol that provides perfect forward secrec

OpenKeychain is a mobile OpenPGP key manager and identity provider used for storing, importing, and organizing encryption keys and digital certificates. It serves as an end-to-end encryption client and digital signature tool for encrypting and decrypting text and files. The application functions as a central vault that provides encryption and decryption services to third-party apps, such as email clients and password managers. It enables secure public key exchange through online directory retrieval and QR code scanning. The project covers cryptographic identity verification, including the ab

Sharedrop is a browser-based file drop application for transferring files directly between devices without requiring software installation or account registration. It uses WebRTC to establish peer-to-peer data channels, allowing files to be exchanged between different operating systems without routing traffic through a central server. The project provides mechanisms for both local and remote connectivity. It identifies active users sharing the same public IP address for immediate local device discovery and allows the creation of private sharing rooms via unique session links for users on diff

CryptPad is a self-hosted, zero-knowledge office suite designed for real-time collaborative editing and content management. It provides a privacy-centric infrastructure where documents, files, and notes are encrypted in the browser before transmission, ensuring that the server administrator cannot access the underlying data. The platform implements zero-knowledge user authentication, utilizing cryptographic keys to verify identities so that plain text passwords are never stored on the server. To further isolate sensitive operations, the system employs a security architecture that separates th

Oblivion is an encrypted tunneling service and internet privacy tool designed to route network traffic through private encrypted tunnels. It functions as a network privacy gateway that masks user identity and encrypts web traffic to prevent tracking and unauthorized surveillance. The project acts as a secure network proxy that combines end-to-end encryption with latency-optimized routing to increase data throughput and reduce network lag. This infrastructure allows for the masking of a device's public identity by relaying connections through a private network. The system provides capabilitie

sshx is a collaborative remote shell tool that enables multiple users to view and control a terminal session through a secure web browser. It provides a web-based terminal sharing platform featuring end-to-end encryption and real-time multi-user cursor tracking. The project utilizes a distributed mesh proxy to route traffic globally and minimize latency. It incorporates predictive echo to mask network delays and provides a multi-terminal canvas layout for managing and resizing multiple shell instances simultaneously. The system supports secure remote access via invitation links and includes

Ockam is a zero-trust networking framework designed to secure data transit between distributed applications using an identity-based network overlay. It provides the primitives necessary to establish mutually authenticated and end-to-end encrypted connections, removing the reliance on traditional network-layer security. The project is distinguished by its use of attribute-based access control and verifiable credentials to manage trust at scale. It implements cryptographic identity rotation to maintain identity continuity and integrates with hardware-backed key management systems to secure priv

Saber is a cross-platform handwriting application and digital ink organizer designed for creating, storing, and managing handwritten notes. It functions as an encrypted note synchronization tool that keeps private content consistent across phones, tablets, and computers. The application features a handwriting interface framework that supports digital document annotation and a hierarchical file system for arranging notes into nested folders. It utilizes client-side end-to-end encryption to secure data before transmission and synchronizes state across devices via a cloud relay. The system incl

Jazz is a local-first relational database and synchronization framework designed for offline-capable applications. It functions as a reactive state management system that treats database records as the primary source of truth, automatically updating user interfaces in real time as underlying data changes. The project distinguishes itself through a collaborative data synchronization model that utilizes row-level versioning to track branching edit histories. It implements a security engine based on identity-claim row security, which enforces granular permissions on individual records, and suppo