We are running on a secure server, but that only protects the information during transfer from client to server. The pages which are delivered however ocassionally require sensitive information to be passed via HIDDEN inputs or worse yet HREF links.

There is no client side secret key required in this case. The server side is the only place encryption/decryption is occuring. Also, the keys used are linked to sessions as well as time-sensitive -- as an additional precaution.

I know that this is not ultra-secure, but I am not protecting Fort Knox -- just trying to disuade nosey people.

Later and thanks all,
Sifmole