Repolode
Submit
wangshengithub

wangshengithub/staticshield

A zero-dependency Node.js tool that encrypts HTML pages (or whole static sites) into self-decrypting files that unlock in the browser with a password.

View on GitHub
Stars
236
Forks
27
Open issues
0
Last commit
3 months ago

What is it?

StaticShield encrypts a single HTML file, or a whole multi-file site, into one self-contained .html file. Visitors see only a password card until they enter the correct password, and the original page is then restored in the browser using WebCrypto. The output is plain static HTML, so it can be hosted on GitHub Pages, object storage, Nginx, or opened locally via file://.

Encryption uses AES-256-CBC with PBKDF2 key derivation (SHA-256 by default, or SHA-512 optionally) at 1,000,000 iterations, and HMAC-SHA256 verifies integrity before decryption. Encryption runs locally through a command-line script or a local web GUI, and the project has no runtime dependencies. The tool is aimed at gating access to internal documents, paid content previews, or temporary private pages, not at resisting determined reverse engineering.

Key features

  • 01Encrypts single HTML files or whole sites with `--bundle`, inlining CSS, JS and images.
  • 02Decrypts in the browser with WebCrypto and needs no backend.
  • 03Supports a CLI for batch processing and a local Web GUI.
  • 04Offers optional remember-me, share links with the password in the URL hash, and password hints.
  • 05Generates random passwords with a CSPRNG via `--gen-pwd`.
  • 06Supports layered encryption by encrypting an already encrypted page again.

Use cases

  • Sharing an internal document on a public static host while requiring a password.
  • Previewing paid or members-only content behind a simple password gate.
  • Publishing a temporary private page on GitHub Pages or an object storage bucket.
  • Encrypting a multi-page static site into a zip for password-protected distribution.

Topics

#encryption#static-site#html#cryptography#password-protection#aes#webcrypto#nodejs#access-control#cli

FAQ

What is staticshield?
A zero-dependency Node.js tool that encrypts HTML pages (or whole static sites) into self-decrypting files that unlock in the browser with a password. StaticShield encrypts a single HTML file, or a whole multi-file site, into one self-contained .html file. Visitors see only a password card until they enter the correct password, and the original page is then restored in the browser using WebCrypto. The output is plain static HTML, so it can be hosted on GitHub Pages, object storage, Nginx, or opened locally via file://.
Is staticshield free to use? What license does it have?
staticshield has no declared license. Its code is public, but without a license you have no explicit permission to reuse it; ask the author before relying on it.
Is staticshield still maintained?
Updated within 6 months. The last commit to staticshield was on Jul 25, 2026.
What can I use staticshield for?
Sharing an internal document on a public static host while requiring a password. Previewing paid or members-only content behind a simple password gate. Publishing a temporary private page on GitHub Pages or an object storage bucket. Encrypting a multi-page static site into a zip for password-protected distribution.
Where can I get staticshield?
The source code and installation instructions are on GitHub: https://github.com/wangshengithub/staticshield

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects