Open code. Ready to inspect.

IcyZip’s browser encryption code and runnable security tests are freely available here. Read, download and test them yourself — no account or phone number required.

Download code & tests (.tar.gz)Test with Docker Browse files Report a weakness

Apache License 2.0 · 28 files · Review version 0.5.0
Source ID (SHA-256): 296aebcea2932277b7d6c8feb888095a38142472d10a57988ebe357d925752a6

Clone with Git — including history

git clone https://icyzip.com/open-source/icyzip-e2ee.git
cd icyzip-e2ee
npm test

The repository is publicly readable. You can inspect and test changes in your own clone. Browse all commits.

Download the complete Git repository (.bundle)

git clone icyzip-e2ee.bundle icyzip-e2ee

main · 70017aa481e1b717fc8930eecd6ba17f39f8ead3 · 7 commits

What is published here

The package contains the complete browser E2EE module, its integration and receive logic, small standalone tests, attack regressions, and protocol and verification documentation. The proprietary server software is outside this package. Relay messages and trust boundaries are documented in the protocol.

The encryption uses WebCrypto: P-256 ECDH, HKDF-SHA-256, HMAC-SHA-256 and AES-GCM. A test using independent Node cryptography APIs also checks the results.

Run the tests

Extract the archive and run these commands in the extracted directory. Node.js 20 or newer is sufficient; the tests need no package installation, server, account or network.

tar -xzf icyzip-e2ee.tar.gz
cd icyzip-e2ee
sha256sum -c SHA256SUMS
npm run test:minimal
npm test

On macOS, use shasum -a 256 -c SHA256SUMS in place of sha256sum. On Windows, extract the archive with an archive utility and run the npm commands in the extracted folder.

Start here: test/minimal.test.mjs · TESTING.md

Compare with the live website

npm run check:live

This optional network check compares the entire encryption module and the three published integration sections byte for byte with the browser files currently served by IcyZip. PROVENANCE.md explains the scope and provenance. PROVENANCE.md

Docker review lab

The public package includes a container recipe with Node.js and inspection tools. No verified registry image is linked here for this source release yet.

Open the container guide

Source and documentation

.gitignore29 bytes · Raw file
.dockerignore597 bytes · Raw file
Dockerfile3,978 bytes · Raw file
CONTAINER.md5,427 bytes · Raw file
container-lock.json1,271 bytes · Raw file
LICENSE11,358 bytes · Raw file
PROTOCOL.md7,734 bytes · Raw file
PROVENANCE.json1,439 bytes · Raw file
PROVENANCE.md3,087 bytes · Raw file
README.md6,021 bytes · Raw file
SECURITY.md2,398 bytes · Raw file
TESTING.md3,920 bytes · Raw file
THREAT-MODEL.md5,964 bytes · Raw file
package.json1,025 bytes · Raw file
src/e2ee.js16,377 bytes · Raw file
src/snapshot.js24,044 bytes · Raw file
test/crypto.test.mjs20,909 bytes · Raw file
test/endpoint.mjs1,345 bytes · Raw file
test/file-receive.test.mjs14,342 bytes · Raw file
test/minimal.test.mjs1,277 bytes · Raw file
test/provenance.test.mjs5,246 bytes · Raw file
test/security-regressions.test.mjs2,057 bytes · Raw file
test/container.test.mjs4,842 bytes · Raw file
tools/snapshot.mjs8,559 bytes · Raw file
tools/fuzz.mjs7,477 bytes · Raw file
tools/inspect.mjs3,456 bytes · Raw file
tools/lab.mjs977 bytes · Raw file
tools/sbom.mjs7,983 bytes · Raw file

Verify downloads

SHA-256 checksums identify the offered bytes. The archive also includes SHA256SUMS for every published file. The source ID is the SHA-256 of that checksum list; identical source IDs identify the same list.

Archive SHA-256: cf9dd9b1be484254f0eeb67246b92d265a655d6de45d262ab22f0e4fb7b0b18c

SHA256SUMS · File list & checksums (JSON)

Reviews and findings welcome

Inspect the code with your own synthetic test data and add reproducible cases. Please report suspected security weaknesses privately; general feedback can be sent without a name or email address.

Security reporting · Forum Feedback