A website for your business
Quick to load, easy to use on a phone, simple for customers to find, and safe from the common attacks.
// secure software engineering
Software, built secure.
I'm Karan, an independent developer in India. I build websites, web apps and mobile apps for small businesses, local organisations and startups, and I build them so they are secure from the first day.
Checked when this site was built
- Built by
- Karan
- Based in
- India
- Registered
- Udyam
- Trackers
- None
Udyam-registered MSME · UDYAM-DL-08-0139210. I reply within 2 business days. For technical readers: how this site is checked
What I can do for you
You do not need to be technical. I explain every decision in plain words, and I build things that are safe from the start rather than patched later.
A web app
A booking system, a client portal or an internal tool, with proper sign-in and access rules.
An Android or iOS app
An app for your customers, or a straight answer on whether you need one at all.
Tools and automation
A small tool that removes a chore you repeat every week.
Personal security help
A password manager, two-step sign-in and backups, set up with you on your own devices.
Free tools
Small utilities I built that run entirely in your browser. Nothing you type is uploaded or stored.
A passphrase made on your device:
Open source
recall
Self-hosted spaced repetition calendar: SM-2 scheduling on a month-view calendar, forgetting curves, flashcard decks, a knowledge graph and dark mode.
JavaScript · MIT
How working with me works
You tell me what you need
A few sentences is enough.
We talk
I ask questions and you ask yours, without jargon.
You get a written plan
What I will build, what I need from you and the price, before any work starts.
I build it in stages
You see progress and give feedback as it lands. Two rounds of changes are included.
I check it and launch it
Security, speed and accessibility checks, then it goes live on hosting you own, followed by a handover walkthrough of up to 60 minutes.
Afterwards
A 30-day window for fixes to what I delivered, and messages acknowledged within 1 business day.
See how pricing works, the concept demos, or how this site is built.
Latest writing
· 5 min read
Web app, PWA, or native app: how to choose
A plain comparison of web apps, progressive web apps and native Android or iOS apps, covering reach, offline use, device features, cost, stores and security.
· 5 min read
Securing a static site on Cloudflare Pages: what is done on this site
What was done on this site: security headers with _headers, Functions limited by _routes.json, a hardened contact form, and zero third-party requests.
· 6 min read
Securing a small business website: headers, forms, and updates
Three things that protect most small business websites: security headers, forms that validate on the server, and a routine for updates.
Start a project
Send a short brief. I reply with questions and a plan within 2 business days.
Or email hello@dekryptsecurity.com.
More projects
whisperdrop
Burn-after-reading pastebin. Text is encrypted in the browser with AES-256-GCM; the key stays in the URL fragment, and the server deletes the paste after one read.
JavaScript
DropZone
Peer-to-peer file transfer between two devices in the browser using WebRTC. Files go directly between devices and are not uploaded to a server.
JavaScript
fitcheck
Command-line tool that counts how many tokens a codebase uses, checks which LLM context windows it fits in, and flags large files.
TypeScript
For technical readers
Measured, not claimed. The numbers come from the build; the live rows are measured in your browser.
- Pages
- 25
- Tools
- 7
- Posts
- 4
- JavaScript dependencies shipped
- 0
- Total site weight
- 2134 KB across 106 files
- Tests
- 291 checks passing, 0 failing (14 Oct 2026)
- Third-party requests on this page
- measured with JavaScript
- Cookies on this page
- measured with JavaScript
| Header | Value |
|---|---|
| content-security-policy | default-src 'self'; img-src 'self' data:; font-src 'self'; style-src 'self'; script-src 'self'; connect-src 'self'; base-uri 'none'; object-src 'none'; form-action 'self'; frame-ancestors 'none'; worker-src 'self' |
| strict-transport-security | max-age=31536000; includeSubDomains |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=(), payment=() |
| cross-origin-opener-policy | same-origin |