AES-GCM encryption in the browser
Pasting text, typing a password and getting back a block of base64 looks like magic, but underneath it runs a well-documented standard: AES in GCM mode, with the key derived from the password through PBKDF2, all inside the browser's own WebCrypto, without the text or the password ever reaching a server.
The bundle stores `iterations: 210000` in its header, so the same password decrypts correctly even if the tool's default iteration count changes later, because the number used at encryption time travels along with the text.
The key derived from the wrong password does not match the 16-byte authentication tag attached to the ciphertext, so WebCrypto rejects the whole operation instead of returning garbled text; that is GCM's integrity guarantee at work, not a bug.
Any value below 100,000 or above 2,000,000 is automatically clamped into that range before key derivation, which rules out both a setting too weak to matter and one heavy enough to freeze the browser.
Entirely in your browser, using the WebCrypto API. The text, passphrase and derived key are never sent, stored or logged on any server.
Because AES-GCM is an authenticated cipher: alongside the ciphertext travels a 16-byte tag computed with the correct key, and WebCrypto checks that tag before returning anything. If the wrong password produces a key that does not match the tag, the whole operation fails with an error instead of producing random bytes disguised as text.
It prevents using the raw password as the encryption key. PBKDF2-HMAC-SHA256 applies the hash function repeatedly, 210,000 times by default in this tool, over the password combined with a random salt, which makes every brute-force attempt against the password hundreds of thousands of times slower than a single direct hash.
Because the 16-byte salt and the 12-byte IV are freshly randomized on every encryption with `crypto.getRandomValues()`. This is intentional: it guarantees semantic security, meaning nobody can tell whether two bundles hide the same text just by looking at them.
No. Encryption and decryption call the WebCrypto API directly in the browser; the base64 bundle that comes out of the tool is already final, with no network call involved anywhere in the encrypt or decrypt process.
The result shows up hereEncryption runs entirely in the browser with WebCrypto. Text, passphrase and derived key are never sent to any server.