A browser-based tool that decrypts happ:// deep links (all five generations: crypt through crypt5) http://leeeet.dev/happ-decryptor/
  • CSS 40.2%
  • JavaScript 32.8%
  • HTML 25.5%
  • Nix 1.5%
Find a file
LeeeeT 8764f4ee71
Fix crypt5 parsing and drop now-redundant selector layer
The crypt5 parser hardcoded a 4-byte header at payload[16:20] and a
684-byte RSA region, and ran the block-pair swap per-slice with a carry
between the URL and RSA fields. That breaks for N >= 1000, non-RSA-4096
keys, and any payload whose URL segment isn't 4-aligned. Switch to a
single whole-payload permute, then carve: marker = shuffled[:4] +
shuffled[-4:], body = shuffled[4:-4], parse the digit-prefixed segment
length dynamically, slice URL and RSA segments by their actual lengths.

With the marker now an 8-char string available directly, selectors.json
is redundant — its (starts, mid, ends) triples just reconstruct the
marker for a lookup that could be done by direct key. Drop it and look
up keys[marker] instead.

Refactor cleanups in the same pass: merge the PKCS#1 and PKCS#8 key
loaders, drop the explicit 'RSAES-PKCS1-V1_5' arg (node-forge default),
simplify the crypt1-4 multi-block concat to a single Latin-1 string
join.

Update the in-page write-up to match: replace the 4-byte-header /
684-byte-RSA layout with the whole-payload permute model, replace the
length-mod-4 selector tail table with the simple marker = first 4 +
last 4 rule, and refresh the pipeline diagram.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-12 21:53:23 -04:00
.github/workflows Initial commit: happ link decryptor web app 2026-04-15 16:39:38 -08:00
public/data Fix crypt5 parsing and drop now-redundant selector layer 2026-05-12 21:53:23 -04:00
src Fix crypt5 parsing and drop now-redundant selector layer 2026-05-12 21:53:23 -04:00
.gitignore Initial commit: happ link decryptor web app 2026-04-15 16:39:38 -08:00
flake.lock Add Nix dev shell and fix crypt5 selector docs 2026-05-09 17:03:38 -04:00
flake.nix Add Nix dev shell and fix crypt5 selector docs 2026-05-09 17:03:38 -04:00
index.html Fix crypt5 parsing and drop now-redundant selector layer 2026-05-12 21:53:23 -04:00
package-lock.json Fix @noble/ciphers v2 import, pipeline rendering, and payload offsets 2026-04-15 17:12:06 -08:00
package.json Fix @noble/ciphers v2 import, pipeline rendering, and payload offsets 2026-04-15 17:12:06 -08:00
README.md Fix crypt5 parsing and drop now-redundant selector layer 2026-05-12 21:53:23 -04:00
vite.config.js Initial commit: happ link decryptor web app 2026-04-15 16:39:38 -08:00

Happ Link Decryptor

Browser-based decryptor for supported happ:// deep links.

The app runs entirely client-side and supports all currently bundled formats: crypt, crypt2, crypt3, crypt4, and crypt5.

Highlights

  • Local decryption in the browser
  • Support for legacy RSA-wrapped links and current crypt5 links
  • 34 bundled crypt5 RSA keys generated from the current APK snapshot
  • Static compatibility data committed in public/data/
  • No APK processing, native emulation, or external services required at runtime

Development

npm install
npm run dev
npm run build
npm run preview

Reverse Engineering Notes

The detailed reverse-engineering log lives in the in-page write-up in index.html.

Runtime Dependencies

Privacy

Decryption happens locally in the browser tab. The app does not upload links or decrypted results to a server.