Inpriv

Zero-knowledge. Client-side only.

A suite of privacy-first web utilities engineered for total digital privacy.

No trackers. No remote logs. No compromises — everything runs in your browser.

Quick links: Website · License · Security · Contributing

Inpriv is an ecosystem of zero-knowledge, fully client-side web utilities — engineered so your sensitive data never leaves your device. No accounts, no servers, no telemetry, no log files. What happens in your browser, stays in your browser.

Why "zero-knowledge"? Because the system — by design — holds zero knowledge about you. There is nothing to leak, nothing to subpoena, nothing to sell.

• Hush — hush.best — E2E encrypted chat. Forward-secret rooms, QR sharing, zero metadata
• Wipe — wipe.inpriv.xyz — metadata (EXIF/GPS) sanitizer for images
• Compress — compress.inpriv.xyz — image compression, no uploads
• Trace — trace.inpriv.xyz — one scan: IP & ISP intel, DNS leak test, WebRTC leak check
• Pay — pay.inpriv.xyz — crypto payment bridge
• Host — host.inpriv.xyz — private static file hosting (Google Drive) with IP-logger/WebRTC-leak scan before publish
• Hash — hash.inpriv.xyz — SHA & MD5 checksums, in-browser
• QR — qr.inpriv.xyz — generate & read QR codes, offline
• Keyring — keyring.inpriv.xyz — zero-knowledge secret vault
• Brute — brute.inpriv.xyz — hash brute-force matcher
• TOTP — totp.inpriv.xyz — RFC 6238 authenticator, encrypted vault
• Burn — burn.inpriv.xyz — ephemeral encrypted notes, read-once
• Stego — stego.inpriv.xyz — hide AES-256 encrypted messages inside PNG images
• Temp — temp.inpriv.xyz — disposable email addresses, live inbox, one-click shred
• Censor — censor.inpriv.xyz — blur/pixelate faces, cards, IPs & tokens on screenshots (on-device auto-detect)
• Share — share.inpriv.xyz — direct device-to-device file transfer over an encrypted P2P tunnel (no uploads, no size limits)
• Labs — labs.inpriv.xyz — public experiment bench: live UI concepts and prototypes under evaluation
• Status — status.inpriv.xyz — live health, response time and 7-day uptime for every Inpriv tool
• Amber — amber.inpriv.xyz — personal web archive: capture pages, browse snapshots by date, read offline (stored on your Google Drive)
• ID — id.inpriv.xyz — Inpriv ID: one account for the whole suite (SSO, @inpriv.xyz address, optional 2FA)
• Mail — mail.inpriv.xyz — zero-knowledge encrypted mail: E2EE inside the suite, external delivery to Gmail/Outlook/any
• Fake — fake.inpriv.xyz — time-limited fake identities for Inpriv ID members (persona, password, real @inpriv.xyz mailbox)

• Zero (wallet) · OSINT · Pass (password generator) · Base64 (encoder/decoder)

• Key exchange — Curve25519 (X25519 ECDH)
• Encryption — AES-256-GCM
• Key derivation — HKDF-SHA-256 + PBKDF2 (100k iterations)
• Randomness — Web Crypto API (crypto.getRandomValues())
• Transport — TLS 1.3 (Hush signaling: wss://)
• CSP — default-src 'self', object-src 'none', frame-src 'none'

Guarantees: ✓ client-side only · ✓ forward secrecy · ✓ zero metadata · ✓ open source

• Frontend — vanilla HTML/CSS/JS, Material Design 3 (Google baseline)
• Crypto — Web Crypto API, Curve25519
• Hush signaling — Python WebSocket server
• Swift editor — Rust
• Edge — Cloudflare (TLS, DDoS protection)

git clone https://github.com/Inpriv/inpriv.git
cd inpriv

# Serve locally (any static server works)
python -m http.server 8080
# → http://localhost:8080

Run your own Hush signaling relay:

cd .hush
pip install -r requirements.txt
python server.py

inpriv/
├── index.html          # Suite landing page (inpriv.xyz)
├── LICENSE             # MIT
├── common/             # Shared worker modules — maintenance gate + branded error pages
├── .hush/              # E2E chat — web app + signaling server
├── .censor/            # Screenshot redactor (blur/pixelate + face/OCR auto-detect)
├── .wipe/              # Metadata sanitizer
├── .compress/          # Image compression
├── .trace/             # IP + DNS + WebRTC leak test (one scan)
├── .host/              # private static hosting — Google Drive + privacy shield
├── .pay/               # Crypto payment bridge
├── .hash/              # Checksum generator
├── .webrtc/            # redirects to trace.inpriv.xyz
├── .qr/                # QR generator/reader
├── .keyring/           # Encrypted secret vault
├── .dns/               # redirects to trace.inpriv.xyz
├── .ipinfo/            # redirects to trace.inpriv.xyz
├── .brute/             # Hash brute-force matcher
├── .stego/             # LSB steganography — hide encrypted messages in PNGs
├── .temp/              # disposable email — random @inpriv.xyz inboxes, Resend inbound
├── .id/                # Inpriv ID — central account & SSO (@inpriv.xyz addresses)
├── .mail/              # Inpriv Mail — zero-knowledge encrypted mail
├── .fake/              # Fake — time-limited fake identities for Inpriv ID
├── .share/             # Share — P2P encrypted file transfer (WebRTC)
├── .labs/              # Labs — public experiment bench
├── .admin/             # admin dashboard — admin.inpriv.xyz (TOTP login, kill-switches)
├── .status/            # Status — live service health & uptime page
├── .amber/             # Amber — personal web archive (Wayback-style, Drive-backed)
├── .zero/              # Crypto wallet (WIP)
├── .osint/             # OSINT engine (WIP)
├── .totp/              # TOTP generator (WIP)
├── .hexa/              # In development
├── ..swift/            # inpriv-swift — Rust text editor
└── .cftcfg/            # Cloudflare Tunnel config manager

• 21 core tools live on production
• PWA + offline support
• Zero wallet — security audit before release
• OSINT — AI-powered intelligence engine
• Security headers + SRI hardening
• i18n (PL/EN)

See CONTRIBUTING.md for full guidelines.

1. No malicious features — modules enabling unauthorized access will be rejected
2. Privacy by design — nothing may ever phone home
3. Open an issue first for big changes
4. Follow the existing M3 design tokens (Google baseline, see .inpriv-labs/inpriv-labs.md)

Found a security issue? See SECURITY.md.

MIT © 2026 Inpriv Labs