Themis is open-source high-level cryptographic services library for mobile and server platforms, providing secure messaging and secure data storage.
Themis provides three important cryptographic services:
Secure Message: a simple encrypted messaging solution for widest scope of applications. ECC + ECDSA / RSA + PSS + PKCS#7. Secure Session: session-oriented, forward secrecy messaging solution with better security guarantees, but more demanding infrastructure. ECDH key agreement, ECC & AES encryption. Secure Cell: a multi-mode cryptographic container, suitable for storing anything from encrypted files to database records and format-preserved strings. Secure Cell is built around AES in GCM (Token and Seal modes) and CTR (Context imprint mode).
Themis by Cossack Labs alternatives and similar libraries
Based on the "Security" category.
Alternatively, view Themis alternatives based on common mentions on social networks and blogs.
Keycloak9.6 9.9 L2 Themis by Cossack Labs VS KeycloakOpen Source Identity and Access Management For Modern Applications and Services
Spring Security9.4 9.9 L4 Themis by Cossack Labs VS Spring SecuritySpring Security
jjwt9.0 0.0 L1 Themis by Cossack Labs VS jjwtJava JWT: JSON Web Token for Java and Android
Cryptomator8.9 9.4 L5 Themis by Cossack Labs VS CryptomatorMulti-platform transparent client-side encryption of your files in the cloud
Apache Shiro8.7 9.3 L3 Themis by Cossack Labs VS Apache ShiroApache Shiro
Bouncy Castle7.8 9.9 L2 Themis by Cossack Labs VS Bouncy CastleBouncy Castle Java Distribution (Mirror)
pac4j7.5 9.3 L4 Themis by Cossack Labs VS pac4jSecurity engine for Java (authentication, authorization, multi frameworks): OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...
jCasbinAn authorization library that supports access control models like ACL, RBAC, ABAC in Java
KeywhizA system for distributing and managing secrets
Google KeyczarEasy-to-use crypto toolkit
Okta Spring Boot StarterOkta Spring Boot Starter
Hdiv3.8 0.0 L2 Themis by Cossack Labs VS HdivHdiv CE | Application Self-Protection
PicketLink3.7 0.0 L4 Themis by Cossack Labs VS PicketLinkUmbrella project for security and identity management.
Nbvcxz3.6 0.0 L3 Themis by Cossack Labs VS NbvcxzPassword strength estimator
Okta Authentication SDK for Javaokta-auth-java
OACC Framework3.0 0.0 L1 Themis by Cossack Labs VS OACC FrameworkOACC (Object ACcess Control) is an advanced Java Application Security Framework
Nimbus JOSE+JWTJSON Web Token (JWT) implementation for Java with support for signatures (JWS), encryption (JWE) and web keys (JWK).
VaultSecures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets. It handles leasing, key revocation, key rolling, and auditing. Through a unified API, users can access an encrypted Key/Value store and network encryption-as-a-service, or generate AWS IAM/STS credentials, SQL/NoSQL databases, X.509 certificates, SSH credentials, and more.
Write Clean Java Code. Always.
* Code Quality Rankings and insights are calculated and provided by Lumnify.
They vary from L1 to L5 with "L5" being the highest.
Do you think we are missing an alternative of Themis by Cossack Labs or a related project?
Themis provides strong, usable cryptography for busy people
General purpose cryptographic library for storage and messaging for iOS (Swift, Obj-C), Android (Java, Kotlin), desktop Java, С/С++, Node.js, Python, Ruby, PHP, Go, Rust, WASM. Perfect fit for multi-platform apps. Hides cryptographic details. Made by cryptographers for developers 🧡
What Themis is
Themis is an open-source high-level cryptographic services library for securing data during authentication, storage, messaging, network exchange, etc. Themis solves 90% of typical data protection use cases that are common for most apps.
Themis helps to build both simple and complex cryptographic features easily, quickly, and securely. Themis allows developers to focus on the main thing: developing their applications.
Use cases that Themis solves
Encrypt stored secrets in your apps and backend: API keys, session tokens, files.
Encrypt sensitive data fields before storing in database ("application-side field-level encryption").
Support searchable encryption, data tokenisation and data masking using Themis and Acra.
Exchange secrets securely: share sensitive data between parties, build simple chat app between patients and doctors.
Build end-to-end encryption schemes with centralised or decentralised architecture: encrypt data locally on one app, use it encrypted everywhere, decrypt only for authenticated user.
Maintain real-time secure sessions: send encrypted messages to control connected devices from your app, receive real-time sensitive data from your apps to your backend.
Compare secrets between parties without revealing them (zero-knowledge proof-based authentication).
One cryptographic library that fits them all: Themis is the best fit for multi-platform apps (e.g., iOS+Android+Electron app with Node.js backend) because it provides 100% compatible API and works in the same way across all supported platforms.
Themis provides ready-made building blocks (“cryptosystems”) which simplify usage of core cryptographic security operations.
Themis provides 4 important cryptographic services:
- Secure Cell: a multi-mode cryptographic container suitable for storing anything from encrypted files to database records and format-preserved strings. Secure Cell is built around AES-256-GCM, AES-256-CTR.
- Secure Message: a simple encrypted messaging solution for the widest scope of applications. Exchange the keys between the parties and you're good to go. Two pairs of underlying cryptosystems: ECC + ECDSA / RSA + PSS + PKCS#7.
- Secure Session: session-oriented encrypted data exchange with forward secrecy for better security guarantees and more demanding infrastructures. Secure Session can perfectly function as socket encryption, session security, or a high-level messaging primitive (with some additional infrastructure like PKI). ECDH key agreement, ECC & AES encryption.
- Secure Comparator: Zero knowledge proofs-based cryptographic protocol for authentication and comparing secrets.
We created Themis to build other products on top of it - i.e. Acra and Hermes.
Refer to the Installation page to install Themis for your mobile, web, desktop, or server-side application. We highly recommend installation packages instead of building from source.
Themis is available for the following languages/platforms, refer to language howtos for each:
|🔶 Swift (iOS, macOS)||Swift Howto||docs/examples/swift|
|📱 Objective-C (iOS, macOS)||Objective-C Howto||docs/examples/objc|
|☕️ Java (Desktop)||Java (Desktop) Howto||Java projects|
|☎️ Java (Android)||Java (Android) Howto||Android projects|
|📞 Kotlin (Android)||Java (Android) Howto||Android projects|
|🔻 Ruby||Ruby Howto||docs/examples/ruby|
|🐍 Python||Python Howto||docs/examples/python|
|🐘 PHP||PHP Howto||docs/examples/php|
|➕ C++||CPP Howto||docs/examples/c++|
|🐹 Go||Go Howto||docs/examples/go|
|🦀 Rust||Rust Howto||docs/examples/rust|
|🕸 С++ PNaCl for Google Chrome||WebThemis project|
Themis supports following CPU architectures: x86_64/i386, ARM, Apple Silicon (ARM64), various Android architectures.
We build and verify Themis on the latest stable OS versions:
- Debian (9, 10), CentOS (7, 8), Ubuntu (16.04, 18.04, 20.04)
- macOS (10.12–10.15, 11)
- Android (4–11)
- iOS (10–14)
- Windows (experimental MSYS2 support)
We plan to expand this list with a broader set of platforms. If you'd like to help improve or bring Themis to your favourite platform or language — get in touch.
Documentation for Themis contains the ever-evolving official docs, which covers everything from deployment guidelines to use cases, with brief explanations of cryptosystems and architecture behind the main Themis library.
Refer to the documentation to learn more about:
- cryptography in Themis (Themis cryptosystems and attacks on them, cryptography donors, key management advice, FIPS 140-2 and GOST),
- debugging and troubleshooting Themis (command-line utilities, Themis Server interactive web simulator, thread safety, migration guidelines between Themis versions),
- Themis architecture,
- Themis security (Themis and OWASP, Themis development security practices),
- community behind Themis (contributing guidelines, credits and honorable mentions, projects that use Themis, tutorials, workshops and talks).
Themis relies on proven cryptographic algorithms implemented by well-known cryptography libraries such as OpenSSL, LibreSSL, BoringSSL. Refer to Cryptograhy in Themis docs to learn more.
This distribution includes cryptographic software. The country in which you currently reside may have restrictions on the import, possession, use, and/or re-export to another country, of encryption software. BEFORE using any encryption software, please check your country's laws, regulations, and policies concerning the import, possession, or use, and re-export of encryption software, to see if this is permitted. See http://www.wassenaar.org/ for more information.
The U.S. Government Department of Commerce, Bureau of Industry and Security (BIS), has classified this software as Export Commodity Control Number (ECCN) 5D002.C.1, which includes information security software using or performing cryptographic functions with asymmetric algorithms. The form and manner of this distribution make it eligible for export under the License Exception ENC Technology Software Unrestricted (TSU) exception (see the BIS Export Administration Regulations, Section 740.13) for both object code and source code.
Submitting apps to the App Store
If your application uses Themis and you want to submit it to the Apple App Store, there are certain requirements towards declaring use of any cryptography.
Read about Apple export regulations on cryptography for Themis to find out what to do.
Each change in Themis core library is being reviewed and approved by our internal team of cryptographers and security engineers. For every release, we perform internal audits by cryptographers who don't work on Themis.
We use a lot of automated security testing, i.e. static code analysers, fuzzing tools, memory analysers, unit tests (per each platform), integration tests (to find compatibility issues between different Themis-supported languages, OS and x86/x64 architectures). Read more about our security testing practices in Themis security docs.
If you believe that you've found a security-related issue, please drop us an email to [email protected]. Bug bounty program may apply.
GDPR, HIPAA, CCPA
As a cryptographic services library for mobile and server platforms, Themis is a "state of the art" encryption tool, which provides secure data exchange and storage.
Using Themis, you can reach better compliance with the current data privacy regulations, such as:
- General Data Protection Regulation (GDPR)
- HIPAA (Health Insurance Portability and Accountability Act)
- DPA (Data Protection Act)
- CCPA (California Consumer Privacy Act)
Read more about Regulations in docs.
Themis is recommended by OWASP as data encryption library for mobile platforms.
Themis is widely-used for both non-commercial and commercial projects, some public applications and libraries can be found here.
Want to be featured on our blog and on the list of contributors, too? Write us about the project you’ve created using Themis!
If you're looking for something to contribute to and gain eternal respect, just pick the things in the list of issues. Head over to our Contribution guidelines as your starting point.
Supporting Themis for all these numerous platforms is hard work, but we try to do our best to make using Themis convenient for everyone. Most issues that our users encounter are connected with the installation process and dependency management. If you face any challenges, please let us know.
At Cossack Labs, we offer professional support services for Themis and applications using Themis.
This support includes, but is not limited to the library integration, with a focus on web and mobile applications; designing and building end-to-end encryption schemes for mobile applications; security audits, for in-house library integrations or high-level protocol; custom application development that requires cryptography; consulting and training services.
Drop us an email to [email protected] or check out the Cossack Labs cybersecurity services.
If you want to ask a technical question, feel free to raise an issue or write to [email protected].
To talk to the business wing of Cossack Labs Limited, drop us an email to [email protected].
*Note that all licence references and agreements mentioned in the Themis by Cossack Labs README section above are relevant to that project's source code only.