Building Secure File Encryption with XChaCha20-Poly1305
A deep dive into the cryptographic choices behind SwatCrypt — why XChaCha20 over AES-GCM, how Argon2id key derivation works, and the pitfalls I avoided.
Read article →10 Apr 2026 7 min read
The Tauri vs Electron debate usually happens between people who haven’t shipped anything with either. Bundle size comparisons, RAM numbers pulled from benchmarks, theoretical arguments about architecture. I’ve shipped four tools with Tauri — QuickProbe, BitBurn, PSForge, and a few others — and maintained Electron apps in a previous role. Here’s the grounded version.
Tauri is a framework for building desktop apps with a Rust backend and a web frontend. The frontend runs in the system webview (WebView2 on Windows, WebKit on macOS, WebKitGTK on Linux). Your frontend code is regular HTML/CSS/JavaScript or whatever framework you prefer — React, Svelte, Vue. The Rust backend exposes functions as Tauri commands that the frontend calls via invoke().
Electron ships its own version of Chromium and Node.js. Your app carries its own browser. That’s why Electron apps are 150+ MB.
QuickProbe is a server fleet management tool for Windows and Linux hosts. The backend connects to Windows machines via WinRM and Linux machines via SSH (using ssh2 with vendored OpenSSL). Active Directory discovery uses ldap3. Credentials are stored in Windows Credential Manager (DPAPI-encrypted), cached in memory for 5 minutes, then dropped. The dashboard refreshes every 120 seconds with exponential backoff for unreachable hosts.
The Tauri command surface for that is substantial — around a dozen backend commands covering server probing, credential management, AD queries, RDP launching, service start/stop, and process management. Each command is an async fn in Rust annotated with #[tauri::command]. The frontend calls them with await invoke('probe_server', { host, creds }) and gets a typed result back.
This is the pattern where Tauri really works. The frontend handles all the display — React 19 components, Tailwind CSS, DaisyUI for the component library. The backend handles everything that requires native access: WinRM sessions, Windows API calls, credential storage. The separation is clear because the language boundary enforces it.
Electron would work here too, but the Node.js side would need to shell out or use native addons for the Windows Credential Manager integration. In Tauri, the windows crate gives you direct API access with compile-time type checking.
BitBurn is a secure file wiping tool. The backend implements four erasure algorithms (NIST 800-88 Clear, NIST 800-88 Purge, Gutmann 35-pass, and custom random passes), a free-space wipe via temporary files, and a cancellation mechanism via Arc<AtomicBool>.
The frontend is React 18 with TypeScript, Tailwind, and DaisyUI. It handles file drag-and-drop, real-time progress display, and algorithm selection. The backend streams progress updates as the wipe proceeds using a 1 MB buffer at approximately 60 fps.
The interesting architectural decision here is that the progress callback crosses the Tauri command boundary as events rather than as a blocking return value. The wipe command starts asynchronously, the frontend receives tauri://wipe-progress events, and the cancel button sends a signal via a separate command. This is the pattern Tauri uses for long-running operations and it works cleanly once you understand the event model.
Total app size: 466 KB for BitBurn. Electron equivalent would start at around 150 MB.
PSForge is a PowerShell IDE built on Tauri with React 19, Monaco Editor (the editor that powers VS Code), and XTerm for the terminal emulator. The backend has over 40 Tauri commands covering script execution, debugging (step over, step into, step out, frame selection), PowerShell discovery, module introspection, code signing via Authenticode, and file association management.
This is the most web-tooling-heavy of the Tauri apps I’ve built and it illustrates both the strength and the limitation of the framework.
Strength: Monaco and XTerm are mature, feature-rich JavaScript libraries. Getting Monaco to work in Tauri is the same as getting it to work anywhere on the web — you import it, configure it, and it works. The 40+ backend commands are individual async Rust functions, each handling one concern. The startup sequence hides the WebView until a psforge-ready event fires, with a 3-second safety timeout, so the user never sees a white flash while the UI initialises.
Limitation: Monaco is built for Chromium. On Windows, Tauri uses WebView2, which is Chromium-based, so you’re fine. On macOS and Linux, you’re using WebKit, and the subtle rendering differences between Chromium and WebKit can surface as visual inconsistencies. For a Windows-only tool this doesn’t matter. For something targeting all three platforms, it’s something to test carefully.
Electron’s advantage is that you always know which browser engine your code runs in. Every Electron app ships Chromium. If you need Chromium-specific behaviour — and some JavaScript APIs are Chromium-only — Electron guarantees it.
The richer runtime also matters for some categories of app. If you need to run arbitrary Node.js code on the user’s machine (build tools, package managers, developer tools that shell out to npm), you already have Node.js available in Electron. In Tauri, shelling out is possible but you’re doing it from Rust rather than from JavaScript, which is a different mental model.
For collaborative, complex applications where the team has strong JavaScript expertise and no Rust experience, the Tauri backend learning curve is a real cost. A team that’s been writing Node.js for five years will be productive in Electron immediately. The same team writing a Tauri backend from scratch is learning Rust while building the product.
Use Tauri if:
Use Electron if:
Use neither if:
For the category of tools I build — focused utilities for sysadmins with heavy Windows API requirements — Tauri is clearly better. The size and memory differences are real, the native Rust backend is the right environment for the system API calls, and the frontend flexibility means I’m not fighting a UI framework when I’d rather be building features.
For a larger collaborative product, or one where the team doesn’t have Rust skills, Electron remains a legitimate choice. It has a larger ecosystem, more predictable cross-platform behaviour, and a more accessible path for JavaScript developers.
What I’d push back on is treating either framework as universally right. Both are good tools for different constraints. The engineers who say “never use Electron” have usually never shipped something with a deadline. The engineers who say “Tauri is too hard” have usually never needed a 4 MB binary that calls Windows Credential Manager.
Tools mentioned: QuickProbe, BitBurn, PSForge. All MIT licensed.