Suppose my website handles sensitive data in the user's browser using Javascript:

let secret = decrypt (thing, ask_user("Password?")); // Global, or reachable via a global

EDIT: the secret is owned by the client user, it is okay if they can read it e.g. in a debugger, it is not okay if a third-party browser plug-in can read it.

How vulnerable is this data?

Example scenarios (not exhaustive):

  1. A malicious person injects their own supplemental script into the page i.e. <script src="attack.js"> -- can attack.js access secret in another script?

  2. A malicious browser extension is installed. Can this extension access secret?

Example scenarios that are out of scope

  • A browser offers a non-standard API to access Javascript variables, or is buggy or otherwise compromised.

  • The attacker is able to alter the legitimate script before it is executed (e.g. to copy secret into an attacker-controlled environment).

  • The browser's memory is being accessed by some other program.

But secret might not be global:

run_async (function () {
   let local_secret = ...

Is local_secret any less vulnerable?

Are there any guarantees offered by Javascript itself that protect secret from being arbitrarily inspected? To what extent can such standards actually be relied-upon?

  • In a way you are asking, "How safe is my bag full of money with a stranger?"
    – Rahul
    Commented Dec 16, 2022 at 16:49

1 Answer 1


TLDR: You should assume that the user can access everything on the client side.

There are many scenarios to implement it. For instance, as you mentioned, user can embed any JavaScript or modify your JavaScript. User can set breakpoints at any place in the code and read any variables. If the result of getting your secrets has a high value and development efforts make sense, then an advanced user can even download source code of the browser and modify it as needed (e.g. write some values to the external log) and build a new browser binary.

You cannot control what the user is doing.

If you need to keep some sensitive data on the client side (I don't talk here about architectural advantages and disadvantages), you may want to use encryption on the server side and send encrypted data to the client. And there are different ways to make sure the data were not modified on the client side, e.g. MAC or PKI based signature.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .