quarto-lock extension: password-protect static Quarto sites with client-side encryption

[lsbjordao]

Description

Hi, everyone!

quarto-lock is a Quarto extension for protecting rendered websites and books on static hosting such as GitHub Pages.

Instead of relying on server-side authentication, it encrypts the rendered output at build time and decrypts it in the browser only after the visitor enters a shared password.

It currently uses PBKDF2-HMAC-SHA-256 for key derivation and AES-256-GCM for authenticated encryption, and can protect not only HTML pages but also local CSS, JavaScript, images, fonts, search indexes, PDFs, ZIP files, and other rendered assets.

The intended use case is publishing private or semi-private static Quarto content where a full authentication backend would be unnecessary or impractical.

A particularly useful deployment pattern is:

private Quarto source
        ↓
GitHub Actions
        ↓
quarto render
        ↓
quarto-lock
        ↓
public repository containing only encrypted output
        ↓
GitHub Pages

The extension is intentionally a cryptographic lock, not an authentication system: there are no users, roles, MFA, password recovery, or server-side authorization, and password strength remains important because encrypted files can be downloaded and attacked offline.

Installation:

quarto add lsbjordao/quarto-lock

Project links:

• Documentation: https://lsbjordao.github.io/quarto-lock/
• GitHub: https://github.com/lsbjordao/quarto-lock
• Live protected demo: https://lsbjordao.github.io/quarto-lock-demo/
• Demo password: quarto-lock-demo
• First release: https://github.com/lsbjordao/quarto-lock/releases/tag/v0.1.0

I’d be very interested in feedback from the Quarto community, especially about deployment patterns, static-site security trade-offs, and possible integration improvements.