Quantum Shield

Quantum Shield is a security tool that helps you become post-quantum ready. It finds risky cryptography, explains why it's exposed, and generates standardized post-quantum keys.

Comment

Credits

Before we start, I want to mention that this application was coded entirely by Claude code; just the idea was mine, and the coding part was left to Claude code.

💡 Inspiration

I kept reading about how quantum computers could one day break the encryption that protects basically everything: bank accounts, passwords, private messages, you name it.

But the part that really got me was something called "harvest now, decrypt later." Hackers don't even have to wait for quantum computers to exist. They can steal your encrypted data today, sit on it, and crack it later once the tech catches up. So stuff you send right now could still get exposed years from now.

The problem? Most developers have no idea which parts of their code are even at risk. And a lot of "security" tools out there love to overpromise stuff like "100% unbreakable!" — which is just not true and honestly kind of dangerous.

So I wanted to build something that:

  • Actually shows you what's risky, in plain English 🔍
  • Helps you start fixing it with real post-quantum crypto 🔐
  • Is honest about what it can and can't do ✅

🚀 What it does

QuantumShield is a web app with a few main modes:

  • 🧪 Scan — Paste your code or drop in some files. It looks for risky crypto like RSA, ECC, MD5, SHA-1, old TLS versions, and even hardcoded passwords or API keys. For every problem it finds, it tells you what it is, how bad it is (Low → Critical), why it's risky, and how to fix it.
  • 📊 Quantum Risk Score — Gives you a score from 0 to 100 and a letter grade (A–F) so you instantly know how exposed you are.
  • 🗺️ Migration Roadmap — Turns your scan results into a clear, step-by-step plan, like "rotate your leaked secrets first, then drop MD5/SHA-1, then start moving RSA to post-quantum."
  • 🔐 Protect — Upload any file and it encrypts it into a quantum-resistant package using real post-quantum encryption (ML-KEM-768) mixed with AES-256. You can decrypt it right back, and if you use the wrong key it fails on purpose so nothing leaks.
  • 🔑 Key Upgrade — Generates real post-quantum keys (ML-KEM, ML-DSA, SLH-DSA) that you can copy or download.

And the whole time, I never said "quantum-proof." I said quantum-resistant, and I remind you it still needs a real security review. No fake hype. 🙅

⭐ Why is it useful

  • 🧠 Most people don't know what crypto they're even using. This finds it for you in seconds.
  • 🛠️ It doesn't just point at problems — it gives you the fix and a real plan to follow.
  • 🔒 You can actually protect real files right now with post-quantum encryption, not just read about it.
  • 🕵️ It's private. Everything runs in your browser, so your files and code never get uploaded to a server.
  • 🎓 You learn while you use it. Every result explains the "why," so it's great for understanding this stuff, not just clicking buttons.

👥 Who uses this

  • 👨‍💻 Developers and small teams who want to check their projects without hiring a security expert.
  • 🛡️ Security folks doing a quick first pass before a deeper audit.
  • 🎓 Students learning about cryptography and quantum computing.
  • 🏢 Companies with sensitive, long-lived data — think health records, finance, or government info — that needs to stay safe for a long time.

🧰 Built with

  • ⚛️ React + Vite (frontend)
  • 🟨 JavaScript
  • 🔐 @noble/post-quantum — real ML-KEM-768, ML-DSA-65, and SLH-DSA (the actual FIPS 203/204/205 standards)
  • 🌐 Web Crypto API — for AES-256-GCM encryption and key derivation, right in the browser
  • 🎨 CSS — hand-made dark and light themes (no template)
  • 🟢 Node.js + Express — an optional backend version of the same logic
  • ▲ Vercel — hosting
  • 🐙 Git + GitHub

🏗️ How we (Claude and I) built it

We started with the brain of the app first:

  • A scanner built on a set of rules (regex patterns) that catch risky crypto and explain each one.
  • A scoring system that adds up the findings and turns them into a 0–100 risk score.
  • A roadmap generator that builds a fix-it plan based on what it found.

Then the crypto. We used @noble/post-quantum for the real post-quantum algorithms, and combined it with AES-256-GCM so you can actually encrypt files. The encryption works like this: post-quantum (ML-KEM) protects a secret key, and that key encrypts your file. To open it back up, you need the matching private key.

After that we built the frontend in React — a dashboard, the scan page, protect page, key page, and roadmap page — and gave it a serious "security product" look with a dark/light theme toggle, a collapsible sidebar, and a glowing risk meter.

Near the end we rebuilt the app to run 100% in the browser so it could deploy as a simple static site. That meant moving all the crypto from Node over to the browser's Web Crypto API.

😅 Challenges we (both Claude and I) ran into

  • 🤔 The post-quantum library was tricky to figure out. The way you call its functions had changed between versions, so the order of the arguments was different from what we expected. We ended up reading the library's type files and writing a tiny test to confirm exactly how to use it instead of guessing.
  • 🚫 GitHub blocked our first upload! We had a fake API key in our demo sample (on purpose, to show the scanner catching it), but it looked so real that GitHub thought it was a live Stripe key and refused the push. We had to make the fake key look more obviously fake. Kind of a funny problem to have.
  • 📦 Deploying was harder than expected. We first tried Vercel, but it didn't like that we had a separate backend server. So we rebuilt the whole thing to run in the browser with no backend at all, which actually made it better.
  • 🔁 Node crypto vs. browser crypto are not the same. Switching to Web Crypto meant relearning how it does things (for example, it sticks the authentication tag onto the end of the encrypted data instead of giving it to you separately).

🏆 Accomplishments that I'm proud of

  • ✅ It uses real post-quantum crypto, not a fake "demo mode."
  • 🔐 The encrypt → decrypt actually works, and using the wrong key fails loudly instead of leaking anything.
  • ⚡ It runs entirely in your browser, so it's fast, private, and deploys anywhere.
  • 🎨 It genuinely looks like a real security product — not a basic school project.
  • 🤝 We stayed honest the whole way. No "100% unbreakable" nonsense.

📚 What I've learned

  • 🧮 How quantum computers actually threaten RSA and ECC (thanks to something called Shor's algorithm), and what the new post-quantum standards are.
  • 🌐 The real differences between Node's crypto and the browser's Web Crypto.
  • 📖 How to read a library's type definitions to figure out the correct way to use it, instead of guessing and hoping.
  • 🐙 A bunch of Git skills: fixing rejected pushes, rebasing, and dealing with GitHub's secret scanning.
  • 💬 That being upfront about a tool's limits actually makes people trust it more, not less.

🔮 What's next for QuantumShield

  • ✍️ Signed packages — sign each encrypted file with ML-DSA and check the signature when you open it.
  • 🔗 Hybrid mode — use classic and post-quantum encryption together for extra safety during the switch.
  • 🗂️ Full repo scanning — point it at a whole GitHub repo and get a heatmap of risky files.
  • 📄 PDF reports — export a clean report you can hand to a teacher, judge, or boss.
  • 🧠 Smarter scanning — understand the code's structure to cut down on false alarms.

Architecture

                ┌──────────────────────────────┐
  Browser  ───► │  React + Vite client (:5173) │
                │  Dashboard · Scan · Protect   │
                │  Key Upgrade · Roadmap        │
                └───────────────┬──────────────┘
                       /api/*  (Vite proxy)
                                │
                ┌───────────────▼──────────────┐
                │  Node + Express API (:3001)   │
                │                               │
                │  scanner.js   rule engine     │
                │  scoring.js   risk score      │
                │  roadmap.js   migration plan  │
                │  cryptoFile.js  AES-256-GCM   │
                │  pqc.js  ◄── crypto-agile ──┐ │
                └─────────────────────────────┼─┘
                                              │
                              @noble/post-quantum (FIPS 203/204/205)
                              ML-KEM-768 · ML-DSA-65 · SLH-DSA
  • Stateless — no database. Files and keys are processed in memory and returned to the browser.
  • Crypto-agile — every PQC call goes through server/lib/pqc.js. Swap the library there and nothing else changes.

Folder structure

QSH/
├─ package.json            # root scripts: dev / dev:server / dev:client / build
├─ README.md
├─ server/
│  ├─ index.js             # Express app + API routes
│  ├─ package.json
│  └─ lib/
│     ├─ scanner.js        # regex rule engine
│     ├─ scoring.js        # 0–100 risk score
│     ├─ roadmap.js        # phased migration plan
│     ├─ cryptoFile.js     # AES-256-GCM + ML-KEM hybrid (KEM-DEM)
│     └─ pqc.js            # ML-KEM / ML-DSA / SLH-DSA wrapper (the agile seam)
└─ client/
   ├─ index.html
   ├─ vite.config.js       # proxies /api -> :3001
   ├─ package.json
   └─ src/
      ├─ main.jsx  App.jsx  api.js  index.css
      ├─ components/  Sidebar · RiskGauge · FindingCard · icons · ui
      └─ pages/       Dashboard · Scan · Protect · Keys · Roadmap

⚠️ Honesty note: QuantumShield is quantum-resistant, not "quantum-proof." It's a risk-assessment and migration helper, and real security still depends on how you store your keys and on a proper review. 🛡️

Quick Note

I put 2 links for the same website of my project; so if one doesn't work please use the other one. Thank you.

Built With

Share this project:

Updates