Documentation · API reference · Releases · Support · Sponsor

The Homomorphic Encryption Engine (HE Engine) is a self-hosted server for computing on data that stays encrypted the whole time. Its users encrypt on their own devices, the engine computes directly on the encrypted values, and only the users can decrypt the results. The server never holds a secret key, so neither it nor whoever runs it can read the inputs or the results.

It is built on TFHE-rs, Zama's implementation of fully homomorphic encryption, with a Rust backend and a web app that does all of its encryption in the browser.

Who it is for

Teams and organisations that want a shared server to compute on sensitive numbers without trusting that server with the data, and individuals who want to compute on a cloud machine they do not fully trust. You run one instance; your users get accounts on it. It is not a hosted product: there is nothing to subscribe to.

Why the HE Engine

• Your keys stay with you. Keys are created in your browser or with the command-line tool. The server receives only an evaluation key, which lets it compute but never decrypt.
• Real computation on encrypted data. Arithmetic, division, bitwise operations, comparisons and sums on signed and unsigned integers from 8 to 64 bits, using TFHE-rs's default parameters (128-bit security according to Zama).
• Programs. Write an expression such as (a + b) * 3 < c ? a : b: the server evaluates every step on ciphertexts, including the encrypted if-then-else and lookup tables, and returns one or several encrypted results. With the SDK, results can come back compressed, about 2 KB instead of 130 to 530 KB each.
• Proven inputs. Clients can attach a zero-knowledge proof that their inputs are well-formed encryptions; the server checks it before computing.
• Use it your way. A web dashboard, a Rust SDK and command-line tool, or a documented HTTP API.
• Built to run. Durable job processing, monitoring, health checks, backups and hardened container images.

How it works

The server holds an evaluation key: enough to compute on your ciphertexts, never enough to read them. How the HE Engine works explains the keys, the architecture and exactly what the server can and cannot learn.

See it in action

The numbers are encrypted in the browser, multiplied on the server without being decrypted, and the result is decrypted back in the browser.

Quick start

Run your own instance with Docker:

cp .env.example .env        # set JWT_SECRET and APP_BASE_URL
docker compose up -d --build

The app is then available at http://127.0.0.1:3000/heaas. For HTTPS, configuration and backups, see Self-hosting.

Prebuilt images are published with each release: ghcr.io/yog-sotho/he-engine-backend and ghcr.io/yog-sotho/he-engine-frontend.

Your users can then also compute from a terminal with the heaas CLI (prebuilt for Linux and macOS on the releases page, or cargo install --path sdk):

export HEAAS_URL=https://<instance> HEAAS_EMAIL=you@example.com
heaas keygen && heaas upload-key                 # your keys, made locally
heaas run --key-id <id> --op multiply 300 300    # 24464 (300 × 300 mod 65536)

Documentation

Everything below is also on the documentation site, https://yog-sotho.github.io/Homomorphic-Encryption-Service.

User guide	Using the dashboard, managing keys, troubleshooting
How the HE Engine works	Keys, architecture, privacy guarantees and limits
Using the API	HTTP API, Rust SDK and the heaas command-line tool
API reference	Every endpoint and schema, generated from the code
Self-hosting	Deployment, configuration, monitoring, backups
Cryptographic parameters	The exact TFHE parameters, generated from the code
Changelog	What changed in each release

Community

• Questions and help: GitHub Discussions; see SUPPORT.md.
• Bugs and feature requests: open an issue.
• Contributing: building, testing and the checks every change must pass are in CONTRIBUTING.md. Everyone follows the code of conduct.
• Security: report vulnerabilities privately; SECURITY.md has the threat model and how to report.

Project status

The HE Engine is pre-1.0. It works end to end and is covered by unit, property, integration and browser tests, with coverage measured in CI. Like all FHE systems, it cannot prove that the server computed correctly; How the HE Engine works lists the limits. The latest code audit is in docs/project/codebase_audit.md.

Author

The HE Engine is written and maintained by Yog-Sotho, who also builds LLM Fine-Tuner.

Support the project

The HE Engine is free and open source. If it is useful to you, you can support its development:

• GitHub Sponsors: github.com/sponsors/Yog-Sotho

• Crypto tips:

  Coin	Address
  Bitcoin (BTC)	yogsotho.blockchain
  Ethereum (ETH)	yogsotho.blockchain
  Tron (TRX)	TBSVzUsQcof9f84aZGbn3wPGVAg3j4ttPv

  yogsotho.blockchain is an Unstoppable Domains name: wallets that support it resolve it to the right address. Check the resolved address before you send.

A ⭐ on GitHub helps too.

Licence

The HE Engine is released under the MIT licence.

It depends on TFHE-rs, which is distributed under BSD-3-Clause-Clear and grants no patent rights. Zama states that TFHE-rs is free for development, research, prototyping and experimentation, and that commercial use requires Zama's patent licence. Obtain that licence before any commercial use of a deployment.