For a while I've seen these companies advertise a way to 'Encrypt HTML source code' so website viewers cannot simply click 'View Source' and steal the code. The very idea that this can be done reliably and securely is just silly. I've seen many sites where people have right clicking disabled so you cannot right click on an image to save it to your computer. It gives the webmaster a since of security but its totally false and should not be trusted.

All of these methods are flawed, lets find out why.

     First of all when you want to view a website your web browser downloads the file from the web server. The file is basically a plain text file that says how to display the contents of the website. There is no current encryption method when displaying a web page. Why is that? Well to do so would require a major change between the web server and the web browser. The bigger issue is there are many different web browsers out there, you can even download a website without the use of a web browser. Note: I'm not referring to the transmission of the website file from the server to your computer, that can be encrypted using SSL. That only encrypts the transmission and not the source code.

     So how are these companies making a product that can encrypt HTML so your web browser can view it but you can't? Well they rely on simple tricks and a little bit of JavaScript. Remember we can see the file, we can read the code and our browser has to understand it, so lets take a look.

http://www.mtopsoft.com/encryptpro/example1.htm

     If you click on that link you will see this company's demo page that is 'protected' by their product. In your web browser click to view the source code.

Look for this line:

eval(unescape("%66%75%6e%63%74%69%6f%6e%20%52%72 ...

     In every page that 'encrypts' HTML source you will see a line like this. Unescape is a JavaScript function that decodes a string that was encoded using the Escape function. The escape function takes a string and takes each character and returns the ASCII code for that character. This is encryption at its most basic level. You can think of this like taking a decimal number and converting it to hexadecimal. So if I take the numbers 123 in decimal the hexadecimal would be 7B. So the numbers look different but its the same number, just in a different format. That is the basics of the HTML Encryption seen here. So that line of code takes string and decodes it, but what is the string? I want to know what it says soo ... I made a nice easy form that does that work for us.

Unescape Translator

Simply paste the contents of that line into the top box and hit Decrypt and now we know what the code is!

Lets take a look:

function RrRrRrRr(teaabb) {
var tttmmm="";
l=teaabb.length;
www=hhhhffff=Math.round(l/2);
if(l<2*www) hhhhffff=hhhhffff-1;
for(i=0;i if(l<2*www) tttmmm = tttmmm + teaabb.charAt(l-1); document.write(tttmmm);};

     Wow looks really confusing right? Well not really they just named their functions weird characters to try and look confusing. This function here is ALL THIS PROGRAM DOES, this code controls everything. Lets take a look, throughout the page the function RrRrRrRr is called and it accepts one string variable, it then does some math calculations a quick "if" statement (in bold) then it writes the content unencrypted. Remember we can edit this code so keeping this really simple, lets just remove the 'if' statement.

     Think about that, it gets the information, then does a calculation and if that is true it displays it unencrypted, well what if the 'if' statement never happened? It would simply get the information then decrypt it, sound simple? It is! So by simply removing the line

if(l<2*www) tttmmm = tttmmm + teaabb.charAt(l-1);

The output code can be viewed easily by just doing the following.

alert(tttmmm);

     Now they have other JavaScript code that finds detects the file and if it isn't located on the server defined in the code it won't display locally on your computer. Thats another way they try to stop you from browsing it locally. Anyways I just wanted to share that with everyone. Please don't trust those programs. One minor final word, Yes I know there are other programs out there that are more complicated than the one I listed with stronger encryption methods, maybe another time I'll review them as well but thats all for now.