Does any one have references or sources on how to approach developing a web application in which the content is encrypted and unreadable for the developers or company owners; I'm referring to content such as legal docs, in which there is a need to keep information confidential for third parties.

The protected data should be the content say of Word docs, some metadata such as author (Lawyer), involved parties and maybe trial type would be searchable and not encrypted but the details and content of the document will be.

It would be visible/decrypt-able by the person (lawyer) who wrote it, by its associates if given permission and by the client (one of the parties in the document).

Ideally the metadata would be extracted and the the content encrypted for subsequent upload and storage

  • 1
    You need to be more specific with your question. what needs to be protected and who should have the ability to view the protected content. Mind you that obfuscation is a totally a different story than encryption and if you wish to protect your content obfuscation is not he way.
    – aviv
    Commented Jul 6, 2014 at 6:22
  • This is similar to what Hushmail uses to protect its users' email data. The password that is used in the login process is actually a passphrase that allows the content to be decrypted temporarily on the server. It also has an option to decrypt the data on the client-side using a Java applet.
    – hololeap
    Commented Jul 6, 2014 at 9:35

2 Answers 2


This depends entirely on what you need the application to do, exactly what data needs to be protected, and who is permitted to view the data.

In the simplest case, where your application is merely an indexing system for documents and the document metadata can be stored in the clear, you can use client-side encryption to protect the document itself: the encryption key never leaves the user's computer, so it's not possible for anyone else to read the document.

In the extreme, you'll need to look into homomorphic encryption. This permits you to operate on encrypted data without knowing what that data is, but it's incredibly slow, and so cutting-edge that most of the security implications are currently unknown.

Your needs probably lie somewhere in between; you'll need to define your problem better before you can decide what solution to use.


Have a look at identity based encryption. Basically you could just use asymmetric encryption to achieve what you want. For example: encrypt everything you put on Facebook. Proof of concept: develop a plugin for Chrome which encrypts everything before it is uploaded to facebook with your private key. You spread your public key to your users. They use the plugin too and use your public key to decrypt your info on facebook. This way the FB servers only get encrypted useless data and your friends can still see the info you put on FB using the plugin and your public key.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .