Open-source alternatives to Sekey

This project is a command-line tool for managing public key infrastructure and digital identities. It provides a comprehensive suite for X.509 certificate lifecycle management, including the generation, signing, renewal, and revocation of certificates and signing requests. The tool distinguishes itself through specialized security capabilities such as binding cryptographic credentials to TPMs and HSMs for hardware-backed identity attestation. It also provides dedicated support for machine identity security, using short-lived SSH certificates and mTLS to secure non-human workloads. Broad capa

itpol is a framework for cryptographic key management, digital signature policies, and security hardening. It provides an IT policy template library and infrastructure access frameworks to establish organizational security guidelines and governance. The project focuses on cryptographic identity management through the use of PGP and SSH keys, alongside a security hardening guide for workstations. It defines standards for software supply chain security, specifically regarding the signing of code commits and software releases to ensure provenance. The system covers a broad range of security cap

Kata Containers is an OCI container runtime that launches containers inside lightweight virtual machines to combine hardware-level isolation with container operational speed. It functions as a hardware-isolated container engine and lightweight VM hypervisor, providing a virtual machine monitor interface that abstracts multiple hypervisors to optimize for performance or specific hardware emulation. The project distinguishes itself through a confidential computing runtime that leverages hardware-backed trusted execution environments, such as Intel TDX and AMD SEV-SNP, to protect data in use. It

FingerprintPay is an Android biometric payment bridge and credential manager that replaces manual password entry with biometric verification for checkout processes in compatible mobile applications. It functions as a tool to authorize payment transactions and automate credential entry through fingerprint verification. The system utilizes hardware-backed security to decrypt stored payment credentials and map biometric identities to encrypted data blobs stored within the device hardware security module. The project covers mobile payment security and automated credential entry by combining hard

andOTP is an open-source multi-factor authentication client for Android. It functions as a time-based and HMAC-based one-time password authenticator for managing two-factor authentication tokens. The application serves as an encrypted vault for authentication secrets, utilizing hardware keystores, passwords, or PINs to secure the account database. It is specifically designed to support automated backups by exporting account databases via system broadcasts for integration with external automation tools. The software covers the management of authentication tokens through QR code scanning and t

Blink is a mobile terminal platform for iOS that combines an SSH and Mosh client with a local shell emulator, snippet manager, and SSH key storage. It renders terminal output using Chromium's HTerm engine for fast display and maintains persistent remote sessions across network changes through the Mosh protocol. The platform supports SSH key-based authentication, WebAuthn hardware security keys, and SOCKS5 proxy tunneling for secure remote access. The terminal environment is built around gesture-based session navigation, allowing users to switch between multiple shells with swipe and pinch ges

This project is a collection of Unix dotfiles and scripts designed to personalize and standardize a shell and operating system environment. It provides portable configurations for the Bash and Fish shells, as well as custom preferences and command mappings for the Vim editor. The collection includes automated bootstrapping scripts to initialize new machines by installing applications, managing package managers, and creating configuration symlinks. It features specialized Git workflow automation to accelerate version control tasks, alongside secure SSH connection management using hardware-base

gocryptfs is a FUSE-based encrypted filesystem that transparently encrypts and decrypts file contents and filenames on disk. It uses block-level authenticated encryption with AES-GCM or AES-SIV-512, binding each block to its file header and offset for integrity, while obfuscating filenames with EME or AES-SIV wide-block ciphers using per-directory initialization vectors. The system derives all encryption keys and initialization vectors deterministically from a master key using HKDF and SHA256, enabling reproducible ciphertext for reliable backup and synchronization workflows. The project dist

This project is a cross-platform credential management suite designed to store sensitive information in encrypted local databases. It functions as a secure desktop application that provides a unified environment for organizing secrets, generating passwords, and managing multi-factor authentication tokens. By utilizing industry-standard file formats, the application ensures that stored credentials remain secure and interoperable across different operating systems. The software distinguishes itself through deep integration with hardware-backed security and system-level services. It supports phy

Keyguard is a password manager application and secure vault designed for storing and organizing logins, passkeys, and sensitive data. It provides a multi-factor authentication vault that utilizes encrypted offline access to ensure credentials remain available without an internet connection. The application includes a dedicated SSH key manager and agent integration for generating and managing keys to access remote servers. It also features a password security auditor that analyzes vault entries to identify compromised, reused, or weak credentials. The system covers a broad range of security c

This project provides a high-performance key-value storage solution for mobile applications, utilizing memory-mapped files to enable rapid read and write operations. It functions as a persistent data layer that integrates directly with the JavaScript runtime to minimize overhead, while supporting reactive state synchronization to ensure interface components update automatically when stored data changes. The storage system distinguishes itself through its ability to manage multiple independent database instances, which organizes data by module and prevents collisions between application compon

Ockam is a zero-trust networking framework designed to secure data transit between distributed applications using an identity-based network overlay. It provides the primitives necessary to establish mutually authenticated and end-to-end encrypted connections, removing the reliance on traditional network-layer security. The project is distinguished by its use of attribute-based access control and verifiable credentials to manage trust at scale. It implements cryptographic identity rotation to maintain identity continuity and integrates with hardware-backed key management systems to secure priv

This project is a security hardening guide and privacy configuration manual for macOS. It provides a comprehensive set of instructions for configuring system settings to improve privacy, reduce the attack surface, and implement a malware defense framework. The guide covers technical methods for validating software notarization, verifying application sandboxing, and auditing system activity. It distinguishes itself by providing detailed workflows for restricting high-risk features and applying advanced security configurations to protect the operating system. The documentation covers several k

ExHyperV is a suite of administrative tools designed for managing advanced Hyper-V configurations, specifically focusing on GPU partitioning, device passthrough, and virtual network switches. It provides a graphical interface to configure virtual machine resources and optimize hypervisor settings. The project is distinguished by its ability to share physical graphics card resources across multiple virtual machines using paravirtualization and partitioning. It also provides specialized utilities for assigning PCIe devices and USB peripherals directly to guest machines for exclusive access. Th

Sui is a blockchain platform featuring an object-centric state model and resource-oriented smart contracts. It utilizes parallel transaction execution to increase network throughput and supports programmable transaction blocks that bundle multiple operations into single atomic units. The platform distinguishes itself with a capability-based access control system and zero-knowledge login mechanisms, enabling users to authenticate via identity providers without seed phrases. It also implements deterministic object addressing to allow predictable state lookups and supports the creation of soulbo

Bazzite is an immutable, atomic-image-based operating system designed for gaming performance and handheld hardware. It utilizes a read-only root filesystem and versioned images to provide atomic updates and instant system rollbacks, ensuring a stable core environment. The system is distinguished by its deep optimization for portable gaming devices, featuring dedicated handheld hardware management for CPU undervolting, fan control, and display refresh rate overclocking. It includes a specialized gaming mode that boots directly into a console-like interface with integrated input mapping and a t

WinSCP is a remote file manager and SFTP and FTP client that provides a graphical interface for browsing, editing, and organizing files on remote servers and cloud storage. It serves as a multi-protocol tool supporting SFTP, FTP, FTPS, SCP, S3, and WebDAV, and functions as an S3 object storage browser for managing files and buckets. The application distinguishes itself through its automation capabilities, allowing for scripted file transfers and remote command execution via a command-line interface or a .NET assembly. It also features directory synchronization to match local and remote folder

Aegis is a mobile application designed to manage and store multi-factor authentication tokens. It functions as a local-first credential vault that generates time-based and counter-based one-time passwords to verify user identity across various online services. The application secures sensitive authentication data by employing authenticated symmetric encryption and hardware-backed key storage to protect credentials at rest. Access to the stored tokens is gated by system-level biometric authentication or password verification, ensuring that only authorized users can retrieve the generated secur

posh-git is a PowerShell extension that provides a Git prompt and a set of toolsets for enhancing terminal productivity. It integrates Git status and branch information directly into the PowerShell command prompt and provides a toolkit for customizing the appearance, colors, and path formatting of the shell session. The project distinguishes itself by providing command line autocompletion for Git commands, branch names, and file paths. It also includes an SSH agent manager with wrapper commands to start, stop, and monitor the status of secure shell agent processes. The software covers broade

OrbStack is a native macOS application that replaces Docker Desktop, providing an all-in-one environment for running Docker containers, full Linux virtual machines, and local Kubernetes clusters. It runs Linux VMs directly on the macOS hypervisor framework for near-native performance, uses VirtioFS for fast bidirectional file sharing between macOS and Linux, and leverages Rosetta for near-native x86 emulation on Apple Silicon. The system assigns predictable local domain names to containers and VMs with automatic HTTPS certificate generation, forwards ports via event-driven updates, and stores

This is a Unix dotfiles repository that provides a central store of configuration files to synchronize application settings and environment variables across different systems. It functions as a standardized development environment setup, offering a consistent profile for code editors, debuggers, and language runtimes across multiple machines. The repository includes specific configuration profiles for shell environments, Git identity and commit authorship, and SSH agent automation for secure credential management. It manages the loading of identity files and integrates system keychains to aut

This project is a Microsoft Teams Linux client that functions as a native desktop wrapper for the web-based communication service. It uses an Electron-based shell to provide system integration and window management for the application on Linux platforms. The client distinguishes itself through a multi-account session manager that uses session partitioning and isolated data directories to allow concurrent access to multiple profiles and tenants. It further integrates with home automation via an MQTT bridge, publishing presence and call status to a message broker and receiving remote commands t

This project is a collection of structured study notes and conceptual breakdowns designed for the AWS Certified Cloud Practitioner exam. It serves as a technical reference and study guide, organizing cloud service details and architectural principles to assist in certification preparation. The knowledge base is built using markdown files and includes curated cheat sheets and interactive mind-map visualizations. These tools map complex certification topics into visual hierarchies to enable drill-down study paths and rapid revision. The materials cover a wide range of cloud capabilities, inclu

ssh2 is a JavaScript implementation of the SSH2 protocol for Node.js, providing the core components necessary to create secure clients and servers. It enables the establishment of authenticated sessions for remote server automation and secure communication. The project distinguishes itself by providing a complete suite of tools for identity management, including utilities for generating and parsing cryptographic key pairs and integrating with external authentication agents. It also functions as a tunneling proxy capable of routing TCP, HTTP, X11, and SOCKSv5 network traffic through encrypted

Prezto is a Zsh configuration framework and shell environment manager designed to organize environment variables, aliases, and startup scripts through a modular file structure. It functions as a plugin collection and prompt theme engine, utilizing Zsh-native scripting to manage shell behavior across different platforms. The framework distinguishes itself through a modular-based configuration and submodule-driven extensions, allowing users to load discrete functional modules and update core components via Git. It features a dedicated prompt engine that integrates repository metadata and system

Fabric is a command-line interface and framework designed to integrate artificial intelligence reasoning into shell-based workflows. It functions as an orchestration tool that connects local data pipelines to remote artificial intelligence services, allowing users to automate content analysis and complex reasoning tasks directly from the terminal. The project distinguishes itself through a modular architecture that treats prompt patterns as version-controlled, reusable logic stored on the local filesystem. By utilizing standard input and output streams, it enables users to chain these analyti