Your files stay on your device
AES-GCM Encrypt and Decrypt
Authenticated encryption with raw keys or PBKDF2 passphrases and a versioned envelope.
60,000-1,200,000
Reusing one IV with the same key breaks GCM confidentiality: random per message is the default.
24 hex digits; random by default and shown after the run.
Authenticated but not encrypted, decrypt needs the same bytes.
The envelope is always base64url JSON regardless. This selects the bare ciphertext rendering.
Encrypt to get a versioned envelope: algorithm, KDF parameters, salt, IV, ciphertext, and tag in one base64url artifact.
Nothing in yet
Paste, drop, or type to begin. Everything stays on this device.