Frontend & Encryption Logic

The Nest frontend is the single point of trust in our system. It is responsible for all cryptographic operations, ensuring that cleartext data never leaves your device.

Cryptographic Foundations

We utilize WebAssembly (WASM) for high-performance crypto:

libsodium-wrappers: Authenticated encryption (AEAD) and secret streams.
hash-wasm: High-speed Argon2id implementation.

High-Performance Chunking

Streaming Encryption

To handle files up to 10GB without crashing the browser, Nest employs a dual-layer chunking strategy. Data is streamed directly from disk to the encryption engine in 64MB memory buffers.

ResumableParallelMemory-Safe

The Decoupled Crypto Engine

A common critique of browser-based encryption is that the server could secretly serve malicious JavaScript to steal keys. Nest defeats this by entirely separating our encryption logic from the main application.

1.Open Source Core: All cryptographic operations are handled by our standalone, open-source NPM package: @lazybird-inc/nest-crypto.
2.Subresource Integrity (SRI): The crypto engine is delivered to the browser with an unforgeable cryptographic hash. If the server tries to alter the encryption code, the browser will instantly block it from running.
3.Verifiable: Security researchers can easily audit the exact cryptography pipeline running in your browser without digging through thousands of lines of UI code.

Implementation Example

Because the engine is standalone, third-party developers can easily build custom clients that integrate with the Nest ecosystem without rewriting the complex WASM-backed crypto.

import { init, encryptFile, generateFileKey } from '@lazybird-inc/nest-crypto';

// 1. Initialize the WebAssembly module
await init();

// 2. Generate a secure random 32-byte key
const fileKey = generateFileKey();

// 3. Encrypt a native browser File object into chunks
const { encryptedBlob, nonce } = await encryptFile(rawFile, fileKey);

// 4. Send the ciphertexts to the backend
uploadToNest(encryptedBlob, nonce);