© 2026 José Carrillo
Zefer vs Hat.sh
Two free, open-source, browser-based encryption tools. Detailed comparison.
TL;DR
Both tools are free, open source, and encrypt files entirely in the browser. Zefer stands out with advanced access controls: expiration, dual passphrase, reveal key, secret question, IP restriction, and attempt limits. Hat.sh stands out with public-key cryptography support (X25519) and 10+ language support. Both are secure for everyday use.
Zefer
- AES-256-GCM + PBKDF2-SHA256
- Configurable PBKDF2: 300k / 600k / 1M iterations
- 7 security layers inside the encrypted payload
- Built-in password generator/analyzer and .zefer inspector
- CLI with an MCP server for AI agents
- 3 languages (ES, EN, PT)
- WCAG 2.1 AA, PWA, dark/light mode
Hat.sh
- XChaCha20-Poly1305 + Argon2id
- X25519 key exchange
- Built on libsodium.js
- 10+ languages including DE, FR, ZH, RU, JA
- Minimal, focused interface
Feature comparison
| Feature | Zefer | Hat.sh |
|---|---|---|
| Strong encryption (256-bit) | ||
| 100% browser-based | ||
| Open source (MIT) | ||
| Chunked encryption (large files) | ||
| File expiration | ||
| Dual passphrase | ||
| Reveal key | ||
| Secret question | ||
| IP restriction | ||
| Max attempts | ||
| Compression (Gzip/Deflate) | ||
| Password generator & analysis | ||
| Encrypted-file inspector | ||
| AI integration (MCP server) | ||
| Public-key encryption (X25519) | ||
| Multiple languages |
Encryption
Zefer uses AES-256-GCM, the standard used by TLS and governments, with hardware acceleration on modern CPUs. Hat.sh uses XChaCha20-Poly1305 via libsodium, which is resistant to timing attacks and performs well in software. For key derivation, Zefer offers PBKDF2-SHA256 with configurable iterations (up to 1 million), while Hat.sh uses Argon2id, considered more resistant to brute-force attacks with specialized hardware. Both algorithms are secure for practical use.
Access control
This is the biggest difference between both tools. Zefer includes 7 access control layers inside the encrypted payload: automatic expiration, dual passphrase, reveal key, PBKDF2-hashed secret question, IP restriction (IPv4/IPv6), decryption attempt limits, and compression before encryption. Hat.sh focuses on simple password or public-key encryption without additional access restrictions.
Public-key cryptography
Hat.sh offers asymmetric encryption with X25519, allowing a sender to encrypt files with the recipient's public key. This eliminates the need to share a password through a separate channel. Zefer does not support public-key cryptography; its model is based exclusively on shared passwords. If your use case requires encryption without sharing passwords, Hat.sh has the advantage.
User experience
Zefer offers a liquid glass design with dark/light mode, installable PWA, native mobile drawer, Telegram-style theme transitions, and WCAG 2.1 AA compliance. Hat.sh has a clean, minimal Material UI interface. Both tools work in modern browsers and are responsive, but Zefer is more optimized for mobile use as an application.
Choose Zefer if...
- You need files to expire automatically
- You want multiple security layers (dual key, secret question, IP)
- You share sensitive credentials with teams
- You need an installable PWA with full accessibility
Choose Hat.sh if...
- You prefer public-key encryption (no password sharing)
- You need support for 10+ languages
- You prefer a minimal interface without advanced options