Encrypt text, files, and whole folders with AES-256. Everything happens on your device — nothing is ever uploaded.
Everything runs with your browser's built-in crypto.subtle engine — the same cryptographic library browsers use for HTTPS. No encryption code was hand-written here; hand-rolled crypto is how most "secure" tools fail.
Your password never becomes the key directly. It's stretched through PBKDF2-HMAC-SHA256 at 600,000 iterations with a random 16-byte salt — the iteration count OWASP currently recommends to make password-guessing attacks slow, even for weak passwords.
The message itself is encrypted with AES-256-GCM, which authenticates as it encrypts: if a single bit of the output is altered later, decryption fails loudly instead of quietly returning corrupted garbage.
A fresh random salt and a fresh random 12-byte nonce are generated for every single encryption, so encrypting the exact same message twice produces two completely different outputs.
The output format is simple and documented, so anyone can verify it:
| Bytes | Field | Meaning |
|---|---|---|
| 0–3 | magic | identifies a Cyphryn file ("AES1") |
| 4 | version | format version |
| 5 | type | 0 = text, 1 = file |
| 6–21 | salt | random, for key derivation |
| 22–33 | nonce | random, for AES-GCM |
| 34+ | … | filename (file mode only), then ciphertext |
Nothing here ever touches a network. You can turn off your WiFi right now and every button on this page still works — that's not a claim you have to take on faith, it's something you can test yourself. The page can also be installed (look for "Install" in your browser's address bar) so it keeps working with no internet connection at all, not just no internet connection after the first load.
Don't want to trust that the file you're running is the real, unmodified one? Every build publishes its exact SHA-256 hash at /CHECKSUM.txt. Save this page, then verify it yourself — in a browser console: crypto.subtle.digest('SHA-256', await (await fetch('app.html')).arrayBuffer()).then(b => console.log([...new Uint8Array(b)].map(x => x.toString(16).padStart(2,'0')).join(''))) — or from a terminal: sha256sum app.html. If it doesn't match, don't trust the file.
Encryption is blocked for passwords scoring below "Fair" on the strength meter — weak passwords are the actual way encrypted data gets opened in practice, never the cipher itself. Use the passphrase generator for a password drawn from the same 2048-word list (BIP39) used to secure cryptocurrency wallets — six random words from it is billions of times harder to guess than most human-made passwords.
An optional keyfile adds a second factor: its SHA-256 hash is mixed into the password before key derivation, so both the password and that exact file are required together. Losing either one has the same effect — there's no partial credit.
Folder vaults work differently: the password is stretched into one key per vault (stored as a salt in a small vault.json file, never the key itself), then every file gets its own random nonce under that shared key — fast to lock hundreds of files, while every file is still independently and uniquely encrypted. Filenames are encrypted too, so a vault folder reveals nothing about what's inside just by looking at it.