Keep it yours.
A simple home for your sensitive files and thoughts.
Learn how encryption works · Linux / OpenSSL guideLet’s lock it up.
01 / INPUTThe algorithm is read from your vault’s authenticated header. No guessing required.
Authenticated encryptionYour passphrase is the key.
02 / PROTECTUse a strong, unique passphrase of 12+ characters (up to 1,024 UTF-8 bytes). Spaces and case matter. Forgotten passphrases cannot be recovered.
Ready when you are.
Made to stay local
Files and passphrases are processed in this tab, not on a server.
Protected, not just hidden
AES-GCM checks for changes before releasing any decrypted data.
Take your vault with you
Download your .sfv file. Keep its passphrase separately and safely.
A few things worth knowing
This is a project-specific SFV v1 format, not compatible with openssl enc. It uses native WebCrypto, PBKDF2-HMAC-SHA-256 (600,000 iterations), a fresh random salt and nonce, and a 128-bit authentication tag. PBKDF2 is not memory-hard. Authentication is not a signature or proof of identity.
Maximum input: 16 MiB per file or 1 MiB UTF-8 text. Processing is in memory, not streamed. Cancel discards work; browser cryptographic operations may not be interruptible. Clear removes references and downloads’ object URLs on a best-effort basis, not secure memory erasure or deletion of saved files.
No telemetry, secret persistence, remote fonts, or external scripts. Hosting still receives normal page requests. A compromised origin, device, browser, or extension can observe secrets. This project has not been independently audited; use established audited local tools for high-risk needs. Decrypted files may be unsafe: download only when intended and open with care.
Read the format, limits & threat model ↗