BlindBit — Secure Searchable Encryption Platform
Privacy-first Django app demonstrating Symmetric Searchable Encryption (SSE) for storing and searching encrypted files using AES-GCM and HMAC tokens.
Overview
BlindBit is a privacy-first Django web application that demonstrates Symmetric Searchable Encryption (SSE) for securely storing and searching encrypted files and records. The platform encrypts user data before storage using AES-GCM, generates searchable tokens using HMAC, and allows users to search encrypted content without exposing plaintext data to the server. It also provides 2FA authentication, trusted-device login, recovery codes, and secure file management.
The Problem
Traditional cloud storage and search systems often require servers to process or store plaintext data, creating privacy risks for sensitive information and exposing users' search intent. BlindBit addresses this by encrypting data before storage, performing searches using secure tokens instead of plaintext keywords, and restricting sensitive operations to authenticated and 2FA-verified sessions.
Approach
- Designed an encrypted storage architecture using AES-GCM authenticated encryption to provide confidentiality and tamper detection for uploaded files and records.
- Implemented HMAC-based searchable tokens so users can search encrypted data without storing plaintext search terms in the server-side index.
- Built a secure authentication flow with password authentication, TOTP-based 2FA, trusted-device verification, lockouts, rate limiting, and recovery codes.
- Implemented session-based key derivation and restricted sensitive operations such as upload, search, download, and delete to authenticated and 2FA-verified sessions.
- Developed multiple SSE search modes including exact, prefix/substring, fuzzy, and phrase/regex-capable search, along with +term and -term query parsing and relevance ranking.
- Added optional decoy lookups to reduce direct observability of search patterns and documented the remaining SSE leakage such as access patterns, repeated search patterns, ciphertext size, and timing.
- Built an interactive encryption playground/visualizer showing the flow from input and key generation to encrypted output and searchable tokens.
Technical Stack
| Layer | Technology |
|---|---|
| Backend | Django 5, Python |
| Database | SQLite |
| Cryptography | cryptography — AES-GCM, HKDF, HMAC |
| Authentication | Django Auth, django-allauth |
| 2FA | TOTP, PyOTP |
| Search | Symmetric Searchable Encryption (SSE) |
| Frontend | Django Templates, HTML, CSS, JavaScript |
| Storage | Encrypted file/blob storage |
| Deployment | PythonAnywhere |
What I learned
- Designing privacy-focused applications using Symmetric Searchable Encryption (SSE).
- Implementing authenticated encryption using AES-GCM and understanding confidentiality and integrity guarantees.
- Using HMAC and keyed tokenization to build searchable encrypted indexes.
- Implementing secure authentication with 2FA, trusted devices, recovery codes, lockouts, and rate limiting.
- Managing session-based cryptographic key material and protecting sensitive endpoints.
- Understanding SSE security leakage, including access-pattern, search-pattern, size, and timing leakage.
- Building secure file upload, encrypted storage, search, download, and deletion workflows.
- Designing interactive security visualizers to make complex cryptographic concepts easier to understand.
- Writing regression tests for authentication, search parsing, recovery flows, and sensitive endpoint protection.