Open code. Ready to inspect.

IcyZip’s browser encryption code and runnable security tests are freely available here. Read, download and test them yourself — no account or phone number required.

Download code & tests (.tar.gz)Browse files Report a weakness

Apache License 2.0 · 19 files · Review version 0.3.0
Source ID (SHA-256): 355f9f80d0ca45db596c9b2a5a4703f021da022ad41b7118ea63cdc3303b79f2

Clone with Git — including history

git clone https://icyzip.com/open-source/icyzip-e2ee.git
cd icyzip-e2ee
npm test

The repository is publicly readable. You can inspect and test changes in your own clone. Browse all commits.

Download the complete Git repository (.bundle)

git clone icyzip-e2ee.bundle icyzip-e2ee

main · 194c1918e76e7e562d2154cee26f7861f160b44d · 5 commits

What is published here

The package contains the complete browser E2EE module, its integration and receive logic, small standalone tests, attack regressions, and protocol and verification documentation. The proprietary server software is outside this package. Relay messages and trust boundaries are documented in the protocol.

The encryption uses WebCrypto: P-256 ECDH, HKDF-SHA-256, HMAC-SHA-256 and AES-GCM. A test using independent Node cryptography APIs also checks the results.

Run the tests

Extract the archive and run these commands in the extracted directory. Node.js 20 or newer is sufficient; the tests need no package installation, server, account or network.

tar -xzf icyzip-e2ee.tar.gz
cd icyzip-e2ee
sha256sum -c SHA256SUMS
npm run test:minimal
npm test

On macOS, use shasum -a 256 -c SHA256SUMS in place of sha256sum. On Windows, extract the archive with an archive utility and run the npm commands in the extracted folder.

Start here: test/minimal.test.mjs · TESTING.md

Compare with the live website

npm run check:live

This optional network check compares the entire encryption module and the three published integration sections byte for byte with the browser files currently served by IcyZip. PROVENANCE.md explains the scope and provenance. PROVENANCE.md

Source and documentation

.gitignore29 bytes · Raw file
LICENSE11,358 bytes · Raw file
PROTOCOL.md6,351 bytes · Raw file
PROVENANCE.json1,439 bytes · Raw file
PROVENANCE.md3,056 bytes · Raw file
README.md5,037 bytes · Raw file
SECURITY.md2,097 bytes · Raw file
TESTING.md2,475 bytes · Raw file
THREAT-MODEL.md4,407 bytes · Raw file
package.json671 bytes · Raw file
src/e2ee.js14,319 bytes · Raw file
src/snapshot.js23,738 bytes · Raw file
test/crypto.test.mjs14,259 bytes · Raw file
test/endpoint.mjs1,295 bytes · Raw file
test/file-receive.test.mjs14,293 bytes · Raw file
test/minimal.test.mjs1,099 bytes · Raw file
test/provenance.test.mjs5,246 bytes · Raw file
test/security-regressions.test.mjs2,057 bytes · Raw file
tools/snapshot.mjs8,559 bytes · Raw file

Verify downloads

SHA-256 checksums identify the offered bytes. The archive also includes SHA256SUMS for all 19 files. The source ID is the SHA-256 of that checksum list; identical source IDs identify the same list.

Archive SHA-256: 34781fb4d967ca3d18b9e48be5256aaf8b0a1e1d5b5a0643224d48fc9a3b5b36

SHA256SUMS · File list & checksums (JSON)

Reviews and findings welcome

Inspect the code with your own synthetic test data and add reproducible cases. Please report suspected security weaknesses privately; general feedback can be sent without a name or email address.

Security reporting · Feedback