The archive · Developer & Business Tools · Product decision · 2022–2023
Portable Secret bets browser-only decryption can beat PGP for normal users; 1,290-pt HN
One encrypted HTML file, decrypted in any browser — built for the creator's mother; its 2022-12-21 Show HN drew 1,290 points.
Portable Secret (mprimi/portable-secret)
What the business is
Portable Secret is a free, open-source hack: an HTML file that carries an AES-GCM-encrypted payload plus Web Crypto JavaScript, so secrets, files and images can be emailed or stored on cloud drives and decrypted in any browser with a password.
How it started
The creator made Portable Secret to securely exchange documents by email with his mother, 'who can't be expected to learn PGP, age, or similar.' He also uses it to store top-level secrets — private keys, 2FA recovery codes — and encrypted copies of documents like a passport picture that he can reach from anywhere, even if all his trusted devices are stolen or lost.
What happened
A Portable Secret is generated by a web tool that wraps the payload in HTML and JavaScript calling the browser's Web Cryptography API: AES-GCM for authenticated symmetric encryption and PBKDF2 for password key derivation, with the page noting that Web Crypto does not support stronger KDFs such as scrypt, bcrypt or Argon2. The project also published a 'Crack me if you can' bounty — an example secret holding the recovery key for a Bitcoin wallet — and a list of similar prior art, while keeping the whole thing deliberately small: 'Portable Secret is not a product and it is barely a project. It is just a neat trick, a hack.'
How it ended up
The author kept it a hack, but the idea was validated externally: a January 2023 update on the page says Rocky W. 'took this idea and ran with it, creating a beautiful full-fledged product: PrivacyProtect.dev' — a commercial product sharing the same no-special-software, browser-only encrypted-HTML approach.
Background
Portable Secret is a self-described hack for better privacy without special software: a Portable Secret is simply an HTML file that contains an encrypted payload and JavaScript that calls the browser's Web Cryptography API, so any reasonably modern browser can open it — even offline — and reveal the secret when given the password. The creator built it to exchange documents securely with his mother by email, since she could not be expected to learn PGP, age or similar tools.
The design bets everything on universality: the file is self-contained with no external dependencies, can be carried on a USB drive, and decrypts on any device with a browser. AES-GCM provides authenticated symmetric encryption, PBKDF2 slows down password brute force, and the page candidly notes that Web Crypto lacks scrypt, bcrypt and Argon2. The same trick stores private keys and 2FA recovery codes in the open, and keeps an encrypted copy of a passport reachable from any device even after a total loss.
The Show HN on 2022-12-21 drew 1,290 points and 376 comments, with the author defending the approach against 'don't roll your own crypto' skepticism and offering a 'Crack me if you can' bounty — an example secret holding the recovery key for a Bitcoin wallet. The author was explicit about scope: 'Portable Secret is not a product and it is barely a project. It is just a neat trick, a hack.'
The idea outgrew the hack anyway: a January 2023 update on the page records that Rocky W. took the idea and built PrivacyProtect.dev, 'a beautiful full-fledged product' for sharing passwords and files with no special software or account. Portable Secret itself remains a demonstration — free, open source, and still live at the 2026-09-05 fetch.
What has to be true
- A concrete origin pain: the creator needed PGP-grade security for email with his mother, who could not be expected to learn PGP — so the constraint was the recipient, not the sender.
- A falsifiable design bet: no special software, no external dependencies, decryptable in any browser even offline — the whole scheme stands or falls on that promise.
- Dated traction: the 2022-12-21 Show HN drew 1,290 points and 376 comments (item 34083366), and the page records PrivacyProtect.dev launching from the idea by January 2023.
- The honest scope is part of the case: the author deliberately refused to turn the hack into a product, which is exactly why the follow-on productization by someone else is the outcome worth recording.
What can be applied
Make the recipient's cost zero: PGP was too much for a non-technical user, yet one HTML file opening in any browser made encryption usable — that simplicity was what someone else productized.
Aftermath
As of 2026-09-05 Portable Secret remains a live demonstration rather than a company: the project page, creator tool, example secrets and bounty page were still reachable, and the GitHub repository (mprimi/portable-secret) remained public. The author's January 2023 update notes that Rocky W. built PrivacyProtect.dev as a full product around the same browser-only encrypted-HTML approach, and the page still describes Portable Secret itself as a hack rather than a product. No company, funding or revenue is documented in the material.
Sources
- Show HN: Portable Secret – How I store my secrets and communicate privately
- mprimi/portable-secret — Better privacy without special software
spotted an error? The archive wants to know.
Your turn
You just read one. Describe what you are building, and see who is betting on the same thing.
Free account · 3 free questions · no card