AES-256-GCM Military-Grade Cryptographic Engine
100% Local Web Crypto API • PBKDF2 Key Derivation • Authenticated GCM
🛡️ 100% Client-Side Air-Gapped Privacy
All cryptographic computations run strictly inside your browser Web Crypto runtime. No keys or plaintexts ever leave your machine.
⚡ Hardware-Accelerated Web Crypto API
Leverages native C++ and hardware AES-NI / SHA instructions through browser APIs for zero-latency throughput.
Frequently Asked Questions & Security Specifications
What makes AES-256-GCM superior to older modes like CBC or ECB?
AES-256-GCM (Galois/Counter Mode) provides authenticated encryption with associated data (AEAD). Unlike CBC which requires separate HMAC checks to prevent padding oracle attacks, GCM mathematically guarantees both confidentiality and message integrity simultaneously.
How are keys derived from the secret passphrase?
The browser derives a 256-bit AES key using PBKDF2 (Password-Based Key Derivation Function 2) with SHA-256, a cryptographically secure 16-byte random salt, and 100,000 hashing rounds to prevent dictionary and rainbow table attacks.
Can the site operator or ISP view my decrypted plaintext?
No. The entire cryptographic lifecycle executes exclusively inside your local browser's Web Crypto API sandbox in client memory. No plaintext, key, or ciphertext is ever transmitted across the network.