Privacy-preserving computation, made tangible

Compute on data
you cannot read.

FHELAB is a working CKKS stack for analytics and search over encrypted inputs. Data is encrypted in the browser, processed as ciphertext on the server, and decrypted only by its owner.

Explore live demos See the architecture
Rust cryptographic core WASM browser encryption 128-bit security target
Live trust boundary CKKS / E2E
01
Your browserEncrypts private input
private
ciphertext only
02
Compute serverCalculates without decryption
blind
encrypted result
03
Your browserDecrypts the answer locally
readable

The secret key never crosses the browser boundary.

Traditional cloud analytics asks you to trust the operator with readable data.

FHE changes the trust model: the operator can run the computation without receiving the plaintext.

Working software

Inspect the technology yourself

Each demo runs real CKKS operations. Simple mode explains the outcome; Detailed mode exposes the cryptographic pipeline.

01Best starting point

Private information retrieval

Query-private vector search

Search a public technical knowledge base while the server receives an encrypted vector—not your readable question.

  • Browser-side query vectorization and encryption
  • Encrypted dot products on the server
  • Local decryption and ranking
Open vector search
02Model marketplace

Encrypted analytics

FHE model marketplace

Choose a public model, encrypt private features in your browser, and receive a result the compute server cannot read.

  • Multiple model contracts
  • Provider and admin workflows
  • Visible key and compute progress
Open marketplace
03Cryptographic lab

Private risk analytics

Encrypted scoring

Follow a feature vector through normalization, CKKS encryption, encrypted evaluation, and local result recovery.

  • Credit, health and cyber scenarios
  • WASM end-to-end mode
  • Ciphertext and accuracy diagnostics
Open scoring lab

Built as infrastructure

One cryptographic core, three execution surfaces

The same parameter contracts and serialization formats connect Rust, Node.js and WebAssembly.

Core

Rust

CKKS encoding, encryption, arithmetic, rotations, rescaling and key management.

Client

WebAssembly

Key generation, input encryption and result decryption inside the browser boundary.

Compute

Node.js

Native bindings for server-side evaluation on ciphertext and operational APIs.

Evidence

Visible pipeline

Progress, parameters, ciphertext fingerprints and plaintext references where appropriate.

Engineering principles

Security claims should be inspectable.

01No plaintext input upload in the intended end-to-end flows.
02No secret key on the compute server. Decryption stays client-side.
03No black-box animation. Technical mode exposes the actual exchange and parameters.

Private-compute pilot

Bring a constrained, high-value computation.

We will help determine whether CKKS is the right fit, define the precision and latency contract, and build a measurable pilot.

hello@fhelab.net