Show HN: Air-gapped File Encryption As Self-decrypting HTML Page

A Show HN post presenting air-gapped file encryption delivered as a single self-decrypting HTML page is drawing attention on Hacker News this week. The project, linked to a public GitHub repository under the organisation ApelegHQ (repo: ts-cms-ep-sfx), proposes encrypting files in a fully offline environment and bundling the decryption capability — the JavaScript needed to unlock the data — directly into an ordinary HTML file that runs in any modern browser.

The submission, titled “Show HN: Air-gapped file encryption as self-decrypting HTML page,” describes a method in which encrypted data and the code required to decrypt it are combined into one portable HTML file. According to the post, the tool is intended for use in air-gapped environments — systems deliberately isolated from networks — where files must be encrypted or decrypted without contacting a server or installing dedicated software.

The linked GitHub repository is hosted by ApelegHQ, an account associated with Apeleg, an Israel-based identity and access management firm. The repository name, ts-cms-ep-sfx, suggests an implementation built with TypeScript and related to CMS EnvelopedData — a long-established cryptographic standard (CMS, Cryptographic Message Syntax) for wrapping encrypted content. This much is consistent with the repository metadata; deeper technical claims about the implementation have not been independently verified.

The core concept behind the project — self-extracting or self-decrypting archives — is a long-established idea in computing, dating back decades in the form of self-extracting executables. What is newer is applying the pattern to the browser: shipping a single HTML file that carries both ciphertext and decryption logic, so a recipient needs nothing but a web browser and the passphrase. Standard web cryptography APIs available in modern browsers make such an approach technically feasible, and browser-based encryption tools have existed for years, but packaging the entire workflow into one offline HTML file remains a niche approach that periodically resurfaces in developer communities.

Why a Browser-Based Decryptor Appeals

The appeal of this approach lies in portability and zero-install decryption. Traditional encrypted archives require the recipient to have compatible software — GPG, 7-Zip, or a dedicated tool — on the receiving machine. A self-decrypting HTML file sidesteps that dependency: any machine with a modern browser can potentially decrypt the payload, which matters in restricted corporate environments, offline machines, or cross-platform workflows where installing software is impractical.

The air-gapped framing is the second draw. Security practitioners who move data across air gaps — journalists, researchers, and operators of isolated infrastructure — need tools that never touch a network. An HTML page that runs entirely from local disk, with no network requests, fits that constraint if implemented correctly. That conditional — if implemented correctly — is also why such projects attract scrutiny: the security of the scheme depends entirely on the correctness of the bundled JavaScript and the underlying cryptography, not on a vetted external application.

The Self-Extracting Archive Tradition

Self-extracting archives have been a fixture of software distribution since the DOS era, when tools like PKZIP allowed compressed files to be packaged with their own extractor. The browser-era equivalent — a single HTML file carrying data plus code — became practical as JavaScript engines and the Web Crypto API matured. Similar single-file HTML tools have appeared repeatedly in developer communities for password sharing, file transfer, and offline utilities.

The use of CMS EnvelopedData, if confirmed by the repository’s contents, would tie the project to a formal standard (defined in RFC 5652 and successors) rather than an ad-hoc file format — a meaningful distinction for interoperability and cryptographic review. Apeleg, the organisation hosting the repository, operates in the cybersecurity and identity-management space, which provides plausible background for the project’s origin, though the company has not issued any public statement about the tool beyond the repository itself.

What the Post Does Not Establish

The trigger for the current attention is unconfirmed. While the Show HN post is verifiable and interest in the topic is observably spiking, it is not clear whether the attention stems from the tool’s technical merits, a discussion thread on Hacker News, broader news coverage, or simple novelty. Engagement figures, community reception, and any independent security review of the code are not available in the source material.

Several technical questions also remain open: which encryption algorithms and key sizes the tool uses, whether the generated HTML files make any network requests, how passphrases are derived, and whether the code has undergone any third-party audit. The repository’s maturity — whether it is a prototype or a maintained product — is likewise unverified. Readers should treat the project’s security claims as unreviewed until an independent assessment exists.

Independent Review Is the Test

The likely next step for any encryption tool of this kind is independent code review. Browser-based cryptography projects typically live or die by community auditing: reviewers will examine whether the self-decrypting HTML file leaks data, whether the implementation handles keys correctly, and whether it relies on well-established primitives such as AES and the Web Crypto API rather than custom cryptography.

Interested readers can monitor the ApelegHQ GitHub repository and the associated Hacker News thread for documentation, issue discussions, and any security analysis. If the project gains traction, a formal audit or comparison against established tools such as age, GPG, or static HTML encryption utilities would clarify whether it offers genuine advantages for air-gapped workflows.

Key Questions

What is a self-decrypting HTML page?

It is a single HTML file that contains both the encrypted data and the JavaScript code needed to decrypt it. Opening the file in a browser and entering the passphrase unlocks the content — no separate decryption software is required.

What does ‘air-gapped’ mean in this context?

An air-gapped system is one deliberately isolated from networks and the internet. A tool designed for air-gapped use must run entirely offline, with no server calls, which the HTML-file approach is intended to support.

Has the tool’s security been independently verified?

No. As of this writing, there is no evidence of an independent security audit or code review in the available source material. Claims about its safety should be treated as unreviewed until experts examine the implementation.

Who is behind the project?

The repository is hosted under the GitHub organisation ApelegHQ, associated with Apeleg, an identity and access management company. No named individual or formal announcement has been verified beyond the repository and the Show HN post.

Are there existing alternatives to this approach?

Yes. Established tools such as GPG, age, and various browser-based encryption utilities handle file encryption, and self-extracting archives are a decades-old concept. The distinguishing feature here is packaging encryption, decryption code, and data into one offline HTML file.

Source: hn