A browser-based architecture for local data analysis and secure file handling
Author: Islam Ayoub
Research area: Computer systems, browser-based computing, privacy-preserving software architectures
Status: Preprint / research prototype
This repository contains the reference implementation, reproducibility materials, and benchmark code associated with the research preprint:
Privacy-Preserving Client-Side Information Processing: A Browser-Based Architecture for Local Data Analysis and Secure File Handling
The work investigates a browser-based architecture in which selected data-processing operations can be performed locally on the user's device rather than requiring raw input data to be uploaded to a remote application server.
The architecture combines browser-native technologies including:
- JavaScript
- WebAssembly
- Web Workers
- TypedArray / ArrayBuffer-based binary processing
- Web Cryptography APIs
The objective is to study the architectural, privacy, performance, and implementation implications of local browser-based processing.
This repository is intended for research, experimentation, reproducibility, and technical evaluation.
This work is a preprint and research prototype. It has not been presented here as a peer-reviewed journal or conference publication.
The benchmark included in this repository is designed to evaluate specific modeled workloads. Its results should not be interpreted as universal performance guarantees for all browsers, devices, networks, files, or production systems.
The reference architecture separates the browser application into several logical components:
Browser Runtime
┌─────────────────────────────────────────────────────┐
│ │
│ ┌───────────────────┐ │
│ │ Main Thread │ │
│ │ / Application │ │
│ └─────────┬─────────┘ │
│ │ │
│ │ ArrayBuffer / structured data │
│ ▼ │
│ ┌───────────────────┐ │
│ │ Web Worker │ │
│ │ │ │
│ │ CPU-intensive │ │
│ │ processing │ │
│ └─────────┬─────────┘ │
│ │ │
│ ▼ │
│ ┌───────────────────┐ │
│ │ WebAssembly / JS │ │
│ │ Processing Engine │ │
│ └─────────┬─────────┘ │
│ │ │
│ ▼ │
│ ┌───────────────────┐ │
│ │ Browser Crypto │ │
│ │ APIs when needed │ │
│ └───────────────────┘ │
│ │
│ User-provided data remains local │
│ when the application is designed that way │
│ │
└─────────────────────────────────────────────────────┘
Network boundary
───────────────────────────────────────────────────────
Remote services are not required for the local-processing path evaluated here
The architecture does not imply that every browser application using these technologies is automatically private or offline. Privacy properties depend on the complete implementation and its network behavior.
The central design principle is:
Process data locally when the required operation can be completed without transmitting the raw input to a remote processing service.
This can reduce the amount of user data that needs to leave the client environment. It does not eliminate all security or privacy risks. For example, an application may still contain:
- third-party JavaScript dependencies
- remote authentication services
- analytics systems
- synchronization services
- browser vulnerabilities
- operating-system vulnerabilities
- malicious or compromised dependencies
- application-level implementation errors
Consequently, the architecture should be evaluated together with an explicit threat model.
The architecture considers user-provided information such as:
- documents
- images
- binary files
- structured records
- cryptographic material
- locally generated intermediate results
The primary threat considered by this research is unnecessary transmission of raw user data to a remote processing service. A local-processing design can reduce this particular exposure when the application does not transmit the raw payload.
The architecture does not claim to protect against:
- a compromised operating system
- a compromised browser
- malicious browser extensions
- malware running with access to the user's device
- compromised third-party JavaScript dependencies
- malicious application code
- side-channel attacks
- physical access to an unlocked device
- deliberate exfiltration implemented by application code
- vulnerabilities in the local processing implementation
The primary trust boundary is the user's device and browser runtime. The browser itself, the operating system, application code, and all loaded dependencies remain part of the security model.
Local processing can support data minimization by avoiding unnecessary transmission of raw input data.
However:
- Local execution alone is not a proof of privacy.
- A privacy claim must consider:
- Network requests
- Third-party resources
- Application telemetry
- Browser storage
- Caching
- Service workers
- Authentication systems
- Dependencies
- Error reporting
- Application source code
For applications requiring strong privacy guarantees, these components should be independently audited.
The repository includes benchmark.js.
The benchmark models the difference between:
- Local browser-side processing
- A client-to-server-to-client processing workflow
The modeled remote workflow includes an upload/network component that is absent from the local-processing path.
The benchmark is not a measurement of a specific commercial cloud provider. It should therefore not be interpreted as evidence that local processing is universally faster than cloud processing.
Performance depends on:
- CPU
- memory
- browser implementation
- WebAssembly engine
- file format
- workload
- network bandwidth
- network latency
- server processing time
- browser scheduling
- device thermal conditions
The benchmark results are therefore workload-specific.
Run the benchmark with Node.js:
node benchmark.jsThe benchmark output should be recorded together with:
- Node.js version
- operating system
- CPU
- memory
- benchmark version
- workload parameters
This makes subsequent measurements easier to compare.
The repository includes demo.html. The demonstration is intended to illustrate local browser-side operations.
Open it directly in a modern browser:
# Simply open demo.html in any modern browserFor a security-sensitive evaluation, network behavior should be independently inspected using browser developer tools or an appropriate network-monitoring environment. The presence of a client-side implementation should not by itself be treated as proof that an application makes no network requests.
.
├── CITATION.cff
├── LICENSE
├── README.md
├── THREAT_MODEL.md
├── BENCHMARK.md
├── SECURITY.md
├── REPRODUCIBILITY.md
├── benchmark.js
├── demo.html
└── privacy-preserving-client-side-information-processing.pdf
The research preprint is archived through Zenodo:
The DOI should be treated as the canonical research identifier.
@misc{ayoub2026privacy,
author = {Ayoub, Islam},
title = {Privacy-Preserving Client-Side Information Processing: A Browser-Based Architecture for Local Data Analysis and Secure File Handling},
year = {2026},
publisher = {Zenodo},
doi = {10.5281/zenodo.22975427},
note = {Preprint}
}Ayoub, I. (2026). Privacy-Preserving Client-Side Information Processing: A Browser-Based Architecture for Local Data Analysis and Secure File Handling. Zenodo. https://doi.org/10.5281/zenodo.22975427
This repository represents a research prototype. The implementation should not be interpreted as a complete security framework or as a universal replacement for server-side processing.
In particular:
- client-side execution does not guarantee confidentiality
- WebAssembly does not automatically make an application secure
- local processing does not eliminate browser or operating-system threats
- benchmark results are workload-specific
- the absence of an upload requirement does not imply the absence of all network traffic
- security properties depend on implementation details
These limitations are an explicit part of the research scope.
The source code and benchmarks are released under the MIT License.
The research paper manuscript and documentation are licensed under the Creative Commons Attribution 4.0 International (CC BY 4.0) License.
This repository uses open web platform technologies and standards including JavaScript, WebAssembly, Web Workers, and browser cryptographic APIs.
Islam Ayoub
Independent researcher in computer systems and browser-based software architectures.