BD × AI Lab · Working technologyDelujoča tehnologija

8Z Shield

Encrypted HTML protection with flexible access. Protect one sensitive section or a whole page; publish the ciphertext and let the browser unlock it.Šifrirana zaščita HTML s prilagodljivim dostopom. Zaščiti občutljivo sekcijo ali celo stran; objavi ciphertext, odklep pa opravi brskalnik.

In production on MDLxDCC.orgV produkciji na MDLxDCC.orgHosted email access · since 9 September 2026Gostovani email dostop · od 9. septembra 2026

8Z Shield is a reusable publishing and security mechanism built by BD × AI. It combines standalone password protection with an optional hosted access layer. The email gate adds a way to obtain access; the underlying HTML payload remains encrypted.8Z Shield je ponovno uporaben mehanizem za objavljanje in zaščito, ki ga je zgradil BD × AI. Združuje samostojno zaščito z geslom in opcijsko gostovano dostopno plast. Email gate doda način pridobitve dostopa; osnovni HTML payload ostane šifriran.

Choose what to protect. Choose how to open it.Izberi, kaj zaščitiš. Izberi način odklepa.

A · Section protectionZaščita sekcij

Protect one sectionZaščiti posamezno sekcijo

Keep the overview, results and context public. Encrypt only selected sensitive HTML sections. The authoring tool 8z_shield_sections.py replaces those sections with encrypted payloads and a browser unlock interface.Pregled, rezultati in kontekst ostanejo javni. Šifrirajo se samo izbrane občutljive HTML sekcije. Avtorsko orodje 8z_shield_sections.py jih nadomesti s šifriranimi payloadi in vmesnikom za odklep v brskalniku.

B · Whole-page protectionZaščita cele strani

Protect a whole pageZaščiti celotno stran

The companion tool bd_html_lock.py wraps a complete HTML document in a self-contained encrypted page. The published wrapper contains ciphertext; the document is rendered after a successful password unlock.Spremljevalno orodje bd_html_lock.py celoten HTML dokument ovije v samostojno šifrirano stran. Objavljeni ovoj vsebuje ciphertext; dokument se izriše po uspešnem odklepu z geslom.

C · Password / standaloneGeslo / samostojno

Unlock with a passwordOdkleni z geslom

No server required for standalone/password mode. Share or host the encrypted HTML without a user database or a server-side login system. A compatible browser uses the supplied password to unlock the content. Portability depends on the chosen build and its assets.Samostojni/geselni način ne zahteva strežniškega login sistema. Šifrirani HTML lahko deliš ali gostiš brez uporabniške baze. Združljiv brskalnik z vnesenim geslom odklene vsebino. Prenosljivost je odvisna od izbrane gradnje in njenih virov.

D · Email-gated / temporary accessEmail / začasni dostop

Add optional hosted accessDodaj opcijski gostovani dostop

On MDLxDCC.org, the visitor enters a syntactically valid email address. No mailbox verification, KYC or identity check is performed. The server logs access and issues a compatible Shield credential; the standard browser session grants access for up to 8 hours.Na MDLxDCC.org obiskovalec vnese sintaktično veljaven email naslov. Predal se ne preverja; ni KYC ali preverjanja identitete. Strežnik zabeleži dostop in izda združljiv Shield credential; standardna seja v brskalniku omogoča dostop do 8 ur.

HTML → select sections or whole page → encrypt → publish ciphertext → password OR hosted email access → browser unlockizberi sekcije ali celo stran → šifriraj → objavi ciphertext → geslo ALI gostovani email dostop → odklep v brskalniku

Both protection tools use AES-256-GCM authenticated encryption. The achievement is the reusable publishing mechanism and its integration, rather than a claim to have invented a new cryptographic primitive.Obe zaščitni orodji uporabljata avtenticirano šifriranje AES-256-GCM. Dosežek je ponovno uporaben mehanizem za objavljanje in njegova integracija, ne trditev o izumu novega kriptografskega primitiva.

The hosted system in use todayGostovani sistem, ki deluje danes

Protected section → email syntax check → server access log → Shield credential → browser unlock → session up to 8 hoursZaščitena sekcija → preverjanje oblike emaila → strežniški zapis dostopa → Shield credential → odklep v brskalniku → seja do 8 ur

This intentionally low-friction gate uses a Netlify Function, a server-side secret and access logging. Optional server-assisted access is available for temporary email-gated sessions; it does not replace the cryptographic Shield. The owner password stays in Netlify’s secret configuration, outside the public HTML and GitHub repository.Ta namerno preprost dostopni prag uporablja Netlify Function, strežniško skrivnost in beleženje dostopov. Opcijski strežniško podprti dostop omogoča začasne email seje; ne nadomešča kriptografskega Shielda. Lastniško geslo ostane v Netlifyjevi konfiguraciji skrivnosti, zunaj javnega HTML in GitHub repozitorija.

On access, the system may record the entered email, server timestamp, IP if supplied by the Netlify runtime, page and user agent. The access flow also submits a record to the Netlify form shield-access. The email is unverified input, not a verified user identity.Ob dostopu lahko sistem zabeleži vneseni email, strežniški čas, IP, če ga poda Netlify runtime, stran in user agent. Dostopni potek pošlje zapis tudi v Netlify obrazec shield-access. Email je nepreverjen vnos, ne preverjena identiteta uporabnika.

Public changes follow GitHub → Netlify: a separate branch, reviewable pull request and Deploy Preview before the approved production merge. The hosted email layer was introduced on 9 September 2026 in PR #5 and tested with an end-to-end check against real Shield ciphertext on both protected page types.Javne spremembe sledijo toku GitHub → Netlify: ločena veja, pregledljiv pull request in Deploy Preview pred odobrenim produkcijskim mergeom. Gostovana email plast je bila uvedena 9. septembra 2026 v PR #5 in preverjena z end-to-end testom proti pravemu Shield ciphertextu na obeh tipih zaščitenih strani.

Protection before unlockZaščita pred odklepom

The protected plaintext is not published as ordinary public HTML. Access depends on the key and the chosen access flow. Password strength and the security of the browser and host still matter.Zaščiteni plaintext ni objavljen kot običajni javni HTML. Dostop je odvisen od ključa in izbranega dostopnega poteka. Moč gesla ter varnost brskalnika in gostovanja ostajajo pomembni.

After a legitimate unlock, a reader can read, save or copy the content. 8Z Shield is not DRM against an authorized reader. The 8-hour limit governs the standard hosted browser session; it does not retract content or credentials that a reader has already copied.Po dovoljenem odklepu lahko bralec vsebino prebere, shrani ali kopira. 8Z Shield ni DRM proti pooblaščenemu bralcu. Omejitev 8 ur velja za standardno gostovano sejo v brskalniku; ne odvzame že kopirane vsebine ali credentialov.

Built through collaborationZgrajeno skozi sodelovanje

BD defines the problem, direction, UX, security policy and requirements, tests the system and makes decisions. AI collaborators contribute a substantial share of the code, implementations, audits and technical proposals. The section-protection source credits Bojan Dobrečevič and Claude Opus 4.6; the whole-page tool is BD HTML Lock v2.1.BD določa problem, smer, UX, varnostno politiko in zahteve, sistem testira ter sprejema odločitve. AI sodelavci prispevajo velik del kode, implementacij, auditov in tehničnih predlogov. Izvorno orodje za sekcije navaja Bojana Dobrečeviča in Claude Opus 4.6; orodje za celo stran je BD HTML Lock v2.1.

8Z Publish is the broader publishing lineage; 8Z-Auth is related research. Earlier capsule, trace and commercialization proposals retain their own dates and evidence status. The production capabilities described above stand on the two protection tools and the deployed email access layer.8Z Publish je širša razvojna linija objavljanja; 8Z-Auth je povezano raziskovalno delo. Starejši predlogi kapsul, sledenja in komercializacije ohranjajo svoje datume in dokazni status. Zgoraj opisane produkcijske zmožnosti temeljijo na obeh zaščitnih orodjih in uvedeni email dostopni plasti.

Production referenceProdukcijska referenca: a95da32… · 2026-09-09

History · original March 2026 8Z Publish presentation (English)Zgodovina · izvirna predstavitev 8Z Publish iz marca 2026 (angleško)

Original wording is retained below as a dated historical record, including research proposals and commercial claims. It is not the current product specification or a verification of every earlier claim. “No server” describes standalone/password architecture. Today’s optional email access uses a server. Current capabilities and limits are stated above; deletion does not revoke copies already obtained, and claims about quantum safety, copy prevention or guaranteed leak attribution are not adopted here.Spodaj je ohranjeno izvirno besedilo kot datiran zgodovinski zapis, vključno z raziskovalnimi predlogi in komercialnimi trditvami. To ni današnja specifikacija izdelka ali potrditev vseh prejšnjih trditev. »No server« opisuje samostojno/geselno arhitekturo. Današnji opcijski email dostop uporablja strežnik. Aktualne zmožnosti in meje so navedene zgoraj; brisanje ne prekliče že pridobljenih kopij, trditve o kvantni varnosti, preprečitvi kopiranja ali zagotovljenem pripisu razkritij pa tukaj niso prevzete.

8Z Framework • A New Software Category

Sell anything.
No server.
No platform.
Just encryption.

8Z Publish lets you encrypt any HTML content — courses, tools, music, newsletters, AI agents — into a .8zv capsule. Host it anywhere for free. Customers decrypt with a passphrase. You keep 97% of revenue. No backend. No login system. No platform tax.

$0
Hosting Cost
AES-256
Encryption
2.9%
Only Stripe
5 KB
Decoder Size

The platform tax is a design flaw.

To sell digital content, you're told you need servers, databases, login systems, and a platform that takes 10–12% of everything you earn. That assumption is wrong.

💰

Revenue Cut

Substack, Gumroad, Patreon take 8–12% of your revenue. On top of payment processing. That's $800–$1,200 per $10K in sales — for hosting files.

🔒

Platform Lock-In

They own the customer relationship. They own the distribution. They change terms whenever they want. Your business runs on their infrastructure and their rules.

Infrastructure Burden

Self-hosting means servers, databases, session management, security patches, SSL certs, and $20+/month minimum. All to gate access to files.

🔥

Attack Surface

Every server is a target. Every database is a breach waiting to happen. Every login system is a password leak risk. Complexity creates vulnerability.

The 8Z Insight

If the content is encrypted and the passphrase is the only key, you don't need a server to protect it. You need good encryption and a browser that can decrypt. Both exist. The server was never necessary — it was a habit.

Five steps. Zero servers.

The entire workflow runs on static files and browser crypto. No backend. No database. No login system.

1

Create

Build your content as HTML — a course, trading tool, music player, newsletter, portfolio. Any web content works.

2

Encrypt

Drop the file into 8Z Shield. Enter a passphrase. Download the .8zv file. Five seconds. No install required.

3

Upload

Host the .8zv on any free static host — Netlify, GitHub Pages, Cloudflare Pages, Vercel, S3. Cost: $0/month.

4

Sell

Create a Stripe Payment Link. Use Zapier to auto-deliver the passphrase on purchase. Customer opens the decoder page, enters passphrase, sees the content.

5

Revoke

Delete the .8zv from your host. The passphrase becomes useless. Instant, atomic revocation. No account suspension workflow needed.

Passphrase
SHA-256 XorShift64Star ×1024 SHA-256 PBKDF2 (10M) AES-256-GCM .8zv

Keep 97% of what you earn.

Every other platform charges you for the privilege of hosting files behind a login page. 8Z Publish doesn't have a login page.

Platform Revenue Cut Server Cost Owns Customer? Quantum Safe
Substack 10% Their server Yes N/A
Gumroad 10% Their server Yes N/A
Patreon 8–12% Their server Yes N/A
WordPress + Plugin Stripe only $20+/mo No No
8Z Publish 2.9% (Stripe only) $0 (free hosting) No — you own it Yes (P=NP safe)

The entire product is static HTML files. The "server" is any free host. The "database" is the filesystem. The "auth system" is AES-256 + a passphrase. Simplicity, pursued honestly, produces resilience that complexity never reaches.

A new class of software object.

The industry offers an unsatisfying choice: distribute a weakly controlled file, or build a full SaaS application. That choice is too narrow. There's a middle layer that's been missing.

Plain Files

Cheap and simple. But once delivered: easy to copy, impossible to revoke, no personalization, no attribution.

The Gap

Full SaaS

Powerful and trackable. But requires backends, accounts, billing, permissions, support, and ongoing ops.

The Thesis

An .8zv file is not just an encrypted file. It's a protected digital capsule — encrypted, personalizable, traceable, revocable, and offline-capable. It gives creators the control of SaaS without the operational burden. Many products are too valuable to give away as files and too small to justify full SaaS. Capsules fill that gap.

🔐

Encrypted

Content is ciphertext until an authorized passphrase unlocks it. At rest, in transit, everywhere.

👤

Personalizable

Each customer receives a distinct build with unique forensic fingerprints baked in.

🔍

Traceable

Multi-channel watermarking lets you attribute leaks to the exact source copy.

🔄

Revocable

Delete the file, passphrase dies. No account suspension workflow, no support tickets.

Partial

Section-level encryption. Only the viewed content decrypts — the rest stays sealed.

Offline-First

Works without network. No server ping. No session. Just a browser and a passphrase.

The Roadmap: From Publish to Capsule OS

The category builds as a ladder, not a leap. Each stage adds a capability layer.

StageFunctionStatus
Publish Whole-artifact encryption and static delivery ✓ Live
Shield Section-level encryption, AI-assisted scanning, reduced plaintext surface ✓ Live
Trace Per-recipient forensic fingerprinting, multi-channel watermarks, leak attribution Building
Capsule Multi-file apps, asset bundles, policy manifests, expiry controls Designed
Vault Long-lived recovery bundles, cold storage, inheritance workflows Planned
Studio Templates, issuance, analytics, distribution, marketplace Vision

Encrypt anything. Sell anywhere.

Any content that can be an HTML file can be a product. The architecture is domain-agnostic — the bytes don't care what they represent.

Online Courses

Encrypt each module as a .8zv. Sell via Stripe. Deliver passphrase on payment. Students decrypt in browser. No LMS, no hosting costs, no piracy via URL sharing.

Trading Tools & Dashboards

Encrypt live trading scanners, calculators, paper traders. Already in production — the author uses this daily for SM and ZZ traders on chessbest.org.

Music & Audio

Encrypt HTML audio players with embedded tracks. Fans buy a passphrase, decrypt, listen. No streaming service, no 30% Apple cut, no takedown risk.

Premium Newsletters

Free tier on your blog, premium tier as .8zv. Replace Substack's 10% with Stripe's 2.9%. Own the customer relationship entirely.

AI Agents & Custom Personas

Package custom AI workflows, trading bots, therapy agents, or game NPCs as protected capsules. The entire agent bundle — UI, logic, prompts, knowledge — encrypted and monetizable.

B2B Partner Delivery

Pricing tools, distributor bundles, onboarding kits, sales enablement packages. Capsules replace heavyweight portals with recipient-specific protected packages.

Legal & Executive Handoff

Board materials, M&A review packs, audit documents. Time-bound, recipient-specific, and traceable — without spinning up a data room.

Private Family Content

Photo albums, family histories, personal journals, video memories. Encrypted and shared with a passphrase. No cloud service, no privacy policy, no account needed.

Cold Storage & Inheritance

Recovery kits, estate instructions, "open only if needed" bundles. Offline-survivable, long shelf life, no dependency on any service existing in 20 years.

What 8Z does — and what it doesn't claim.

The strongest version of this system doesn't need to overclaim. Clear boundaries build more trust than vague promises of invincibility.

What 8Z delivers

  • AES-256-GCM encryption at rest and in transit — before unlock, content is indistinguishable from random noise
  • Section-level decryption: only the viewed section enters the DOM, the rest stays sealed
  • Per-customer forensic fingerprinting across multiple channels (ZWS steganography, synonym swaps, honey-links)
  • Leak attribution with confidence scoring — identify the source copy when content surfaces
  • Lightweight revocation: delete the file, revoke the access. No admin panel required
  • Offline operation: no server ping, no session, no heartbeat. Just a browser and a passphrase
  • 10M-iteration PBKDF2 + XorShift64Star Software PUF: brute-force costs measured in centuries, not hours

What no client-side system can do

  • Guarantee perpetual secrecy after a legitimate user has viewed the content
  • Prevent screenshots, screen recording, or manual retyping
  • Replace all forms of server-side trust for every use case
  • Provide perfect DRM in adversarial-client environments
  • Beat hardened public API auth as a universal standard for mass consumer apps
  • Prevent key sharing between users who trust each other
The Right Security Objective

The goal is not "make plaintext impossible forever." The goal is: minimize exposure surface, personalize every copy, attribute leaks forensically, and make revocation atomic and free. That's a real and achievable security posture — and it's stronger than what 95% of digital products have today.

Three components. Zero dependencies.

The entire system is three things: an encryptor, a decoder, and encrypted files. All static. All portable. All permanent.

🔐

Encryptor

Browser-based or Python CLI. Gzip + AES-256-GCM with the 8Z key derivation pipeline. Produces .8zv files.

🔓

Decoder

5 KB self-contained HTML. Zero dependencies. Uses Web Crypto API. Wrong passphrase = blank page, no error oracle for attackers.

📦

.8zv Capsules

Encrypted content capsules. Host on any static server. Portable, permanent, platform-independent. One capsule per product or per customer.

Where the architecture leads.

The same encryption pipeline that protects an HTML page can protect anything that's bytes. The system generalizes further than the current tools show.

GPU-Level Protection

Lazy decryption extended to GPU compute shaders — model weights encrypted in VRAM, decrypted only during inference, zeroed after each layer pass.

Capsule Format Standard

A recognized container format for controlled digital objects — as natural as .zip or .app, but with built-in encryption, policy manifests, and lifecycle hooks.

Peer-to-Peer Distribution

WebRTC swarms where encrypted capsules propagate without servers. The encryption makes the transport layer irrelevant — the content is self-protecting.

Domain Explosion

Medical records with consent-gated decryption. Military briefings on USB sticks. Family archives that survive 50 years without any service dependency. The same architecture, applied recursively.

Most existing solutions solve only one layer. File encryption solves protection. SaaS solves lifecycle. Static hosting solves delivery. Capsules combine enough of these layers to create a new operational model — software objects rich enough to sell as products, light enough to ship without becoming an operations company.

Encrypt your first file in 30 seconds.

No install. No sign-up. No server. Open the browser encryptor, drop a file, enter a passphrase, download your .8zv.

⚡ Open 8Z Shield Read the Technical Paper →
8Z Publish • AIM³ Institute • Bojan Dobrečević • March 2026
Synthesized by Claude Opus 4.6 • Research contributions: ChatGPT, Gemini, Grok
Open 8Z ShieldTechnical Paper8Z-Auth