I've written about this, here: http://stackoverflow.com/a/24677597/19212 http://stackoverflow.com/a/24677597/19212, in response to the question "Can local stora

I've written about this, here: http://stackoverflow.com/a/24677597/19212 http://stackoverflow.com/a/24677597/19212, in response to the question "Can local storage ever be considered secure?", and in particular using encryption from the SJCL. Here is the gist, copied for convenience: > There are libraries that do implement the desired functionality, e.g. Stanford Javascript Crypto Library. There are inherent weaknesses, though (as referred to in the link from @ircmaxewell's answer): - Lack of entropy / random number generation; - Lack of a secure keystore i.e. the private key must be password-protected if stored locally, or stored on the server (which bars offline access); - Lack of secure-erase; - Lack of timing characteristics. > Each of these weaknesses corresponds with a category of cryptographic compromise. In other words, while you may have "crypto" by name, it will be well below the rigour one aspires to in practice. > These concerns will likely be addressed in the WebCrypto API, but that is not here yet.