100% Client-Side Web Crypto
Zero-Persistence Guarantee: Keys and plaintext are processed in memory and never saved to storage.
✓ GCM provides confidentiality & tamper-proof authentication.
A cryptographically random 16-byte salt is generated for each encryption and bundled into the output package.
Plaintext to Encrypt:
Encrypted Package (Base64 Envelope):
🛡️ Authenticated AES-GCM
AES-GCM is the modern gold standard. It simultaneously provides confidentiality and cryptographic integrity verification via an authentication tag, preventing tampering or bit-flipping attacks.
🎲 Random IVs on Every Encryption
Every single encryption automatically uses a freshly generated random Initialization Vector (IV). Reusing an IV with the same key in AES-GCM is catastrophic and destroys cryptographic security.
🔑 Key Derivation with PBKDF2
Passphrases are transformed into high-entropy cryptographic keys using PBKDF2 with SHA-256 and OWASP-recommended iteration counts (600,000+) along with a unique random salt.
⚠️ The "No Backdoor" Principle
AES encryption is mathematically irreversible without the exact key or passphrase. There is no backdoor, recovery tool, or master password if the key is lost.