WEBCAT
WEBCAT helps people trust the websites they use by verifying the code running in their browser.
New WEBCAT update: independent evaluation, standards work, and a growing team
The problem
Websites can change their code at any time, and HTTPS alone does not guarantee that every user receives the same, intended web application. WEBCAT addresses this by enabling signed delivery and transparency log–backed distribution of participating web applications, allowing end users to verify exactly what they received from a website.
How WEBCAT works
- Decentralized infrastructure records the trust configuration of participating domains.
- Transparency logs record signed manifests describing web applications, making changes publicly auditable and tamper-evident.
- The WEBCAT browser extension verifies locally: (a) that the manifest served by a domain is valid and anchored in its declared root of trust and (b) that the web application and its execution environment match the manifest.
Architecture
All the WEBCAT components are open source. Specification in progress.
📜 Transparency logs
⛓️ Enrollment chain
2 of 3 nodes must agree on every change
📦 Verification libraries
🔭 Monitoring and auditing
Auditor or developer
Watches for unexpected changes
News
- WEBCAT update: independent evaluation, standards work, and a growing team May 4, 2026
- Help us test WEBCAT alpha March 3, 2026
- See you at Real World Crypto Symposium Feb. 24, 2026
- WEBCAT: Towards auditable web application runtimes Dec. 18, 2025
- Introducing WEBCAT: Web-based Code Assurance and Transparency March 19, 2025
For developers and website administrators
If you want to enroll your website or adapt your web application to use WEBCAT, these resources will help you get started.
Research
- G. Berra. WEBCAT: Web-based Code Assurance and Transparency. Master's thesis, IACR ePrint 2025/797, 2025.
- G. Berra. A decentralized integrity and transparency model for web applications. Talk, Transparency.dev Summit, 2025.
- E. Alkotob, G. Berra, B. Beurdouche, R. Hansen, D. Huigens, D. Jackson, C. Myers, M. Rosenberg. Improving the Trustworthiness of Javascript on the Web. Talk, Real World Crypto, 2026.
- S. Schwarz, F. Bauckholt, L. Trampert. Trust on Reload: Securing Browser-Based End-to-End Encryption. ACM Web Conference, 2026.