As others have mentioned, the JS for the crypto is fetched from the server every time, which is a weak spot because the server could give you duff crypto code.

As others have mentioned, the JS for the crypto is fetched from the server every time, which is a weak spot because the server could give you duff crypto code. I've looked at similar things before, and I became very interested in Data URLs. Here's an example that PGP-encrypts files and uploads them to DropBox: https://bitbucket.org/geraintluff/encrypted-drop https://bitbucket.org/geraintluff/encrypted-drop The idea is that you can fit a very small implementation of SHA-256 as inline JavaScript in an HTML page. This means that you can produce a 1500-character Data URL which loads, SHA-256 verifies and executes the external resources needed to bootstrap your app. I started a whole module loader based on this concept, so you could do fancier things like async/parallel loading, adding more verification methods (e.g. public key, once that module is loaded) and so on: https://bitbucket.org/geraintluff/caution.js https://bitbucket.org/geraintluff/caution.js