Mohammadali
ENفا

Mohammadali

محمدعلی

I am a computer engineering student and software developer. I build software that runs entirely in your browser — no server to trust, no account to make, nothing sent home — mostly in TypeScript, React and Rust.

See the projects GitHub
At a glance
RoleCE student · developer
StackTypeScript · Rust · React · Svelte
FocusSoftware that needs no server
NowBuilding Sayso

Projects

Everything I’ve built

One rule runs through all of them: if it can run in your browser, it should. Each is explained below — what it believes, how it is built, and its architecture, exploded.

NameKindStatusYear
TEXTOR.EXEMessengerLive2026
TWOFA.EXEAuthenticatorLive2026
ELEET.EXECipher cabinetLive2026
SAYSO.EXEEncrypted drop boxIn development2026
TSEQ.EXEQuant systemUnreleased2026
PAPYRA.EXEWord processorUnreleased2026
MAMMADALI.HTMThis siteLive2026

7 projects · 0 backendsAll repositories on GitHub

MessengerLive2026

Textor

A private messenger that is nothing but a web page.

Philosophy

There is no Textor server to compel, breach or shut down, because there isn’t one. Your identity is a key made in your browser and backed up as twelve words; messages are sealed before they touch the network. It also lists its own limits — no forward secrecy for direct messages yet, no push notifications — because a privacy tool that only lists its strengths isn’t being straight with you.

Architecture

Each message is a NIP-17 private message: sealed with NIP-44, then gift-wrapped (NIP-59) under a one-time key with a fuzzed timestamp and a padded size, and sent to several public Nostr relays that act as dumb encrypted mailboxes. When both people are online, a direct WebRTC channel delivers it instantly. Inside the browser the UI never touches a transport or the database: it goes through the store, the engine and the vault, and the core runs in Node under test.

Spec sheet
Backendnone
Identity12 words (NIP-06)
Installunder 800 KiB
LicenceAGPL-3.0
  • TypeScript
  • React
  • Nostr
  • WebRTC
  • MLS
  • PWA
Open textor.irSource
  1. React UIscreens · i18n · RTL
  2. Zustand storea projection for the UI
  3. Messenger enginereceipts · retries · dedup
  4. VaultXChaCha20 · keyslots
  5. Nostr transportrelay pool · WebRTC
  6. Public relaysciphertext only
Architecture, top to bottom

AuthenticatorLive2026

TwoFA

Two-factor codes, to the second and to yourself.

Philosophy

A zero-knowledge authenticator whose whole case rests on auditability. It makes six claims — secrets never leave the device, only your passphrase or passkey can decrypt, storage reveals nothing, codes are correct, it works offline, there is nothing to trust beyond the repository — and each comes with the mechanism that enforces it and a way to check it yourself. No runtime dependencies, so nothing else can land in the bundle.

Architecture

Envelope encryption: a random, non-extractable 256-bit key seals the vault with AES-256-GCM, and each unlock method — a passphrase through calibrated PBKDF2, or a passkey through the WebAuthn PRF — wraps that key separately, with every parameter bound into the AAD so storage cannot be downgraded. Codes follow RFC 4226 and 6238 over WebCrypto, checked against all 28 published vectors. Even the QR encoder and decoder are written in-tree.

Spec sheet
Runtime deps0
Bundle≈ 36 kB JS, gzipped
Tests110
LicenceMIT
  • TypeScript
  • WebCrypto
  • WebAuthn
  • PWA
Open twofa.irSource
  1. Signal UIno framework
  2. VaultAES-256-GCM envelope
  3. Key wrappersPBKDF2 · passkey PRF
  4. OTP engineRFC 4226 / 6238
  5. QR codecReed–Solomon, in-tree
  6. Service workeroffline precache
Architecture, top to bottom

Cipher cabinetLive2026

Eleet

A cabinet of secret writing, from the scytale to SHA-3.

Philosophy

Text tools on the web are either ad-filled pages that post your text to a server, or workbenches with a cliff of a learning curve. Eleet sits between: 55 instruments filed by what they actually do to text — so leet speak sits among the substitution ciphers, a peer of Caesar and Enigma — with illustrated historical dossiers in both languages. Nothing you type ever leaves the browser.

Architecture

A framework-agnostic engine declares every tool as a typed option schema plus pure functions, and the UI generates its forms from that schema. The engine runs in a module Web Worker behind a typed RPC with cancellation, so the interface never blocks, even during a deep automatic decode. Share links compress their state into the URL fragment, which browsers never send to the host.

Spec sheet
Instruments55
Dossiers14, in two languages
Tests329
LicenceMIT
  • TypeScript
  • Svelte 5
  • Web Workers
  • WebCrypto
Open eleet.irSource
  1. Svelte 5 UIforms generated from schemas
  2. Sessions + routerstate in the URL fragment
  3. Engine RPCtyped · cancellable
  4. Web Worker50 transforms · 4 analyzers
  5. Language modelbigram beam decoder
  6. Service workeroffline shell
Architecture, top to bottom

Encrypted drop boxIn development2026

Sayso

Sealed messages and large files to a repository’s owner, from a static page.

Philosophy

A static page cannot accept writes, and GitHub accepts them only from signed-in accounts. Sayso turns that constraint into the design: anyone can send end-to-end encrypted messages and large files to the owner of a GitHub repository, with no backend, no accounts and no secret in the page. Before you click, it tells you plainly what will be public.

Architecture

The core is Rust compiled to WebAssembly. Envelopes are sealed with X-Wing — ML-KEM-768 hybridised with X25519 — and ChaCha20-Poly1305, because a sealed envelope may sit in public long enough to meet a quantum adversary. Delivery tries three tiers in order: a live, end-to-end encrypted QUIC connection through iroh, a public store-and-forward buffer, then a GitHub Actions courier that writes ciphertext into a private vault.

Spec sheet
Statusmilestone 1 of 4
Key exchangeX-Wing (ML-KEM-768 + X25519)
CoreRust → WebAssembly
Security reviewnot yet
  • Rust
  • WebAssembly
  • iroh
  • Post-quantum
  1. Web pagesender view · owner dashboard
  2. sayso-wasmthe JavaScript-facing API
  3. sayso-wirethe protocol over iroh
  4. sayso-coreformats · cryptography
  5. Three tierslive wire · buffer · courier
  6. Data branchsigned manifest · epochs
Architecture, top to bottom

Quant systemUnreleased2026

TSEQ

A quantitative trading system for the Tehran Stock Exchange that runs entirely in the browser.

Philosophy

The “server” is a static file host. Ingestion, feature engineering, training, backtesting and inference all happen client-side — no backend, no build step, no npm — and if its one remote script cannot load, it falls back to classical models instead of breaking. Evaluation is held to a quant’s standard: purged, embargoed walk-forward splits, and early stopping on rank correlation rather than loss.

Architecture

Market data flows through a hedged proxy fabric into an IndexedDB corpus that survives reloads. About seventy cross-sectional features per symbol feed a pooled multi-head network, trained with TensorFlow.js in a Web Worker on your own GPU, that predicts relative rather than absolute returns, with direction and quantile heads. A LinUCB contextual bandit then reallocates across twelve alpha sleeves, rewarded by what they actually returned.

Spec sheet
Statusunreleased
Modelpooled multi-head, TF.js
Features~70 per symbol
Build stepnone
  • JavaScript
  • TensorFlow.js
  • Web Workers
  • IndexedDB
  1. Canvas chartsa hand-written engine
  2. LinUCB allocator12 alpha sleeves
  3. Multi-head netTF.js in a Web Worker
  4. Feature panel~70 per symbol
  5. IndexedDB corpussurvives reloads
  6. Proxy fabrichedged relays
Architecture, top to bottom

Word processorUnreleased2026

Papyra

Write and export a real .docx in the browser, with right-to-left built in from the ground up.

Philosophy

Most “write it and export a .docx” jobs need neither a desktop suite nor a cloud account. Papyra is a small, honest tool that does that one thing, with right-to-left text as a first-class citizen rather than a bolted-on afterthought. When it imports a document, it reports exactly what it simplified or dropped instead of failing silently.

Architecture

A React and TypeScript editor built on TipTap. Documents are generated as genuine .docx files in the browser with the docx library, imported through mammoth.js, and checked for fidelity with docx-preview. Everything is kept in IndexedDB with JSON backup and restore, and the whole app deploys as a static site.

Spec sheet
Statusunreleased
Outputreal .docx
StorageIndexedDB, on your device
Backendnone
  • TypeScript
  • React
  • TipTap
  • RTL
  1. React UIRTL-first
  2. TipTap editorProseMirror document model
  3. Importmammoth.js · fidelity report
  4. Exportreal .docx, in the browser
  5. IndexedDBJSON backup and restore
Architecture, top to bottom

This siteLive2026

mammadali.ir

A 1997 homepage, rebuilt to modern standards.

Philosophy

Hand-written, with no framework and no runtime dependencies, under a performance budget the build enforces: the first screen of every page must arrive in the first network round trip. Both languages are done properly — Persian is its own pre-rendered page with real right-to-left layout and typography, not translated strings swapped in by a script.

Architecture

A dependency-free Node script renders each language to static HTML with its CSS inlined, and GitHub Actions verifies the output and publishes it to Pages. All the 3D is CSS transforms — a wireframe tunnel made of 1px elements, exploded architecture stacks, a cube — driven by one requestAnimationFrame loop that runs only while something is moving.

Spec sheet
Runtime deps0
First screen≤ 14 KB, gzipped
3DCSS transforms only
WebfontsPersian pages only
  • HTML
  • CSS
  • JavaScript
  • Node.js
Open mammadali.irSource
  1. Static HTMLone page per language
  2. Inline CSSlogical properties · RTL
  3. CSS 3Dtunnel · stacks · cube
  4. app.jsone rAF loop, deferred
  5. Node buildzero dependencies
  6. GitHub Pagesdeployed by Actions
Architecture, top to bottom

Principles

What they have in common

Different problems, the same convictions. These are the rules every project above is built to.

No server to trust

Each project runs entirely in your browser. The backend is a static file host, or public infrastructure anyone can run — never a server of mine you have to take on faith.

Seen in Textor · TwoFA · Eleet · Sayso · TSEQ · Papyra

Your keys stay with you

Identities and secrets are made on your device and stay there: twelve words, a passkey, an envelope key. There is no password reset, because nobody else holds a copy.

Seen in Textor · TwoFA · Sayso

Claims you can check

Every guarantee names the mechanism that enforces it and how to verify it yourself: published test vectors run in CI, a strict Content-Security-Policy, threat models written to be falsifiable.

Seen in TwoFA · Textor · Eleet

Limits, said out loud

Each one states up front what it cannot do: no forward secrecy yet, no push notifications, no security review yet. A tool that only lists its strengths is not being straight with you.

Seen in Textor · Sayso · TwoFA

Persian is first-class

Right-to-left layout and Persian typography are designed in from the start, not translated in at the end — down to Persian digits, Finglish and fixing text typed on the wrong keyboard layout.

Seen in Textor · Eleet · Papyra · mammadali.ir

Small on purpose

Few or no dependencies, and budgets the build enforces: Textor installs in under 800 KiB, TwoFA ships about 36 kB of JavaScript, and this page paints from its first 14 KB.

Seen in TwoFA · Textor · mammadali.ir

About

A little context

I am a computer engineering student, and most of what I do outside coursework is building software and putting it on GitHub.

Almost everything I build follows one rule: if it can run in your browser, it should — no server to trust, no account to make, nothing sent home. The rest is care: that it loads fast on a slow connection, reads correctly in both directions, and says honestly what it cannot do.

Right now I am building Sayso, and keeping Textor, TwoFA and Eleet moving.

Toolbox

What I work with

GroupTools
Languages
  • TypeScript
  • JavaScript
  • Rust
  • HTML
  • CSS
Web platform
  • React
  • Svelte
  • Web Workers
  • WebAssembly
  • Service workers
Crypto & networking
  • WebCrypto
  • WebAuthn
  • Nostr
  • WebRTC
  • iroh
Tooling
  • Vite
  • Node.js
  • Vitest
  • GitHub Actions

Contact

Get in touch

Open to collaboration on open-source work, and happy to talk about anything on this page.

Follow on GitHub