Hello everyone, dear Zevist family!
(I preferred to include this project in the Art section since it is an art form, even software is an artistic expression of human ingenuity and therefore a type of art!)
I want to share a personal project I've been working on independently: BastetCipher, a tool that does two distinct but integrated things — it deterministically strengthens passwords and manages encrypted file archives with an in-memory viewer that never writes anything to disk.
This isn't a commercial project, there's no data collection, no telemetry. It's a single HTML file that runs entirely offline in the browser (In fact, it is recommended to do everything offline without an internet connection; this is the best practice for HoS subscribers.).
WHAT IT ACTUALLY DOES
1. Deterministic cipher generator
You enter a secret phrase + a PIM (a number that acts as a second factor) and, optionally, an "amplifier" (0-9999) that extends the length of the output. The system runs a 9-step pipeline — SHA-256/384/512, a proprietary 4-stage transformation, PBKDF2-HMAC-SHA512 with iteration counts ranging from 50,000 to 600,000 depending on the PIM — and always produces the exact same output for the same input. Change even a single digit of the PIM and you get a completely different cipher.
It's designed for people who want extremely strong, reproducible passwords without having to store them anywhere. You remember phrase + PIM, and you regenerate the same password every time.
2. Sacred Vault — encrypted file archive
You can pack up to 1,024 files into a .bca archive (a proprietary binary format), encrypted with AES-256-GCM and then AES-256-CBC in cascade, with the key derived via PBKDF2-HMAC-SHA512 at 200,000 iterations. The archive can be extracted as a standard .zip, or opened in memory: files can be browsed and viewed inside a sandboxed iframe, without ever writing the decrypted content to disk.
THE HONEST COMPARISON WITH 7-ZIP AND VERACRYPT:
- 7-Zip (encrypted): when you open a file inside it with an external program, that file is often decompressed into a temporary system folder before being opened. It's a plaintext file on disk, even if only briefly.
- VeraCrypt: mounts an encrypted volume as an actual filesystem. Excellent security for the volume itself, but as soon as you open a file inside it with an external app (PDF reader, video player...), that file passes through the entire operating system stack — application caches, indexing, thumbnails, antivirus scanning.
- BastetCipher: the built-in viewer keeps everything inside a single iframe on the same page — no external program involved, no explicit disk writes. This removes an entire category of risk compared to the "mount volume → open with external app" workflow.
That said, this is NOT "impossible" in an absolute sense — the operating system can still page RAM to disk (swap) under memory pressure, regardless of what the browser does. That's why the app includes an in-app operational security guide on how to disable hibernation/swap, or alternatively encrypt the entire disk. This is a real limitation of the browser environment, not a hidden flaw — and I'd rather state it clearly than sell it to you as magic.
WHY IT'S MORE CONVENIENT THAN USING VERACRYPT OR 7-ZIP FROM THE COMMAND LINE:
- Zero installation: a single HTML file, just open it, even from a USB drive.
- Zero dependencies: no external libraries, no network requests (the CSP explicitly blocks every outbound connection).
- An interface anyone can understand, even without cryptography background: you don't need to know what a mounted volume or a LUKS header is — you just drag your files in.
- Full portability: the same file works identically on any system with a modern browser.
- Multi OS: Windows/Linux/MacOS/Solaris/BSD etc..
TECHNICAL TRANSPARENCY (for those who want to verify it themselves)
The project is open source, MIT licensed. You can read every single line:
- Repository: https://github.com/darkblows/BastetCipher
- Archived backup: https://archive.org/details/bastetcipher
The repo's README documents the entire cryptographic pipeline step by step, including the .bca binary format, so anyone with the skills can independently verify what the code does instead of just taking my word for it.
AN HONEST DISCLOSURE, NOT A BOILERPLATE DISCLAIMER:
Some design choices in this project are conscious trade-offs, not hidden flaws:
- The salt is deterministic (not random) in order to guarantee password reproducibility — this means the entire security burden falls on the quality of the chosen phrase + PIM, not on the algorithm itself.
- The double-layer encryption (GCM + CBC) is defense-in-depth, not a mathematical security multiplier.
Feedback, technical criticism, and bug reports are all welcome — that's how a project like this improves.
Oh, and one last note:
Have you noticed how incredibly lightweight the file is? And that's the beauty of using an interpreted language. 😎
🐈⬛ Honor to the Goddess Bastet! ⚕️