Browser-based HPKE demo — RFC 9180 hybrid public key encryption. KEM + KDF + AEAD composed into one scheme, every stage inspectable. Base, PSK, Auth, AuthPSK modes. Edit the info string or AAD and watch real AEAD reject. The composition underlying TLS ECH, Oblivious HTTP, and MLS. No backends. No simulated math.

Post-quantum polyfill for the Web Cryptography API: ML-KEM (FIPS 203) and ML-DSA (FIPS 204) per the WICG Modern Algorithms draft — native-first with a wasm engine, plus a DHKEM-over-ECDH (RFC 9180) migration extension.