From file to ciphertext.

What happens to your file here?

1. Plaintext + exact passphraseYour file bytes or UTF-8 text. Passphrase spaces, case and Unicode matter.
2. Fresh salt → password KDF → keyPBKDF2-HMAC-SHA-256, 600,000 iterations, random 16-byte salt. PBKDF2 is not memory-hard.
3. AES-GCM + fresh nonce + header256-bit key by default (128-bit optional), random 12-byte nonce, full header authenticated as AAD.
4. Ciphertext + 128-bit tag → .sfvThe header stores the version, cipher, KDF settings, salt and nonce; filename metadata is encrypted. Download explicitly.

Going the other way

SFV header → validate bounds → same passphrase + stored salt → same key → authenticate/decrypt → plaintext. The app reads cipher and KDF metadata for you. The tag covers ciphertext and the header; no plaintext is released until authentication succeeds. Wrong passphrases or changed ciphertext/tag cause a generic authentication failure. Unsupported/malformed headers are rejected before key derivation.

The salt and nonce are not passwords and need not be secret. They do not let someone recover a strong passphrase, but attackers can attempt offline guesses. Authentication is not a digital signature or proof of identity. See the exact SFV format and return to the browser vault to create or open .sfv files.

Start with a disposable practice file.

These are commands for your own Linux terminal—not JavaScript, not something this page runs. Only decrypt files you own or are authorized to access. Use a maintained OpenSSL 3.x package from your distribution; ask its package manager/admin if OpenSSL is missing. First inspect your installed version and supported flags:

openssl version
openssl enc -help

Core flags below are documented in OpenSSL 3.0 and 3.5. The automated Linux command test reports the exact version it runs. The examples deliberately use the common default salted format (8-byte salt in these versions), not the newer -saltlen flag, which OpenSSL 3.0 does not support. Do not assume all releases, vendor builds or provider configurations have identical capabilities. Using AES or PBKDF2 alone does not establish FIPS validation/compliance.

umask 077
workdir=$(mktemp -d "${TMPDIR:-/tmp}/file-vault-demo.XXXXXXXX") && cd "$workdir"
pwd

umask 077 restricts permissions on new files to their owner (normally 600 for files, 700 for directories). It does not fix permissions of existing files. mktemp -d creates a new private directory; $(...) captures its path. && changes directory only if creation succeeds. pwd prints where you are. If setup reports an error, stop. Run subsequent blocks only inside the new directory. This is a private workspace, not a guarantee of secure storage; temporary directories may be cleaned automatically.

printf '%s\n' 'PUBLIC practice file. Not a real secret.' > './original.bin'

This is intentionally nonsecret text. printf writes the literal sample and a newline; > writes it to a file and overwrites an existing file. The .bin name is just a name; encryption works on bytes of any file type. For your own file, work on a copy in a private directory instead, and keep the original safe. Never put sensitive text into a literal shell command: shell history and process arguments can expose it.

Encrypt and decrypt a file in the terminal.

No authentication: these AES-256-CBC examples hide content but do not protect it from tampering. Use the authenticated browser vault or an established authenticated file-encryption tool for important data—not bare CBC. OpenSSL CMS is a different, certificate/key-based workflow; this beginner guide does not claim a tested authenticated CMS recipe.

Use a strong, unique passphrase. The commands deliberately omit -pass: OpenSSL prompts interactively, with confirmation on encryption and no terminal echo. Do not place a real password in command arguments, environment variables or shell history. The passphrase is not embedded in the file. Lost passphrases cannot be recovered.

Before every command, ensure its output path does not already exist. OpenSSL -out can truncate/overwrite a file, even if decryption later fails. The examples use three distinct names and never delete the original. Do not point input and output at the same file.

openssl enc -aes-256-cbc -e -pbkdf2 -iter 600000 -md sha256 -salt \
  -in './original.bin' -out './original.bin.enc'

At the two prompts, type the same passphrase. The output is binary by default: a salted OpenSSL header and AES-CBC ciphertext with PKCS#7 padding. The .enc extension is a convention, not stored algorithm metadata or proof of security.

openssl enc -aes-256-cbc -d -pbkdf2 -iter 600000 -md sha256 -salt \
  -in './original.bin.enc' -out './recovered.bin'

Enter the exact original passphrase at the prompt. Use the same cipher, digest, PBKDF2 settings, salt convention and encoding. A zero exit status means the operation completed and padding was accepted, not that the result is authentic.

cmp './original.bin' './recovered.bin' && printf '%s\n' 'Practice files match byte for byte.'

cmp compares the two local files; it is normally silent if they match. && prints the success message only on a match. This tests a round trip while you still have a trusted original. It does not add authentication to CBC or establish trust in files received later.

What OpenSSL does in this example

1. File bytes + prompted passphraseNo text conversion. The filename itself is not encrypted/stored by enc.
2. Random salt → PBKDF2-HMAC-SHA-256600,000 iterations derive the 32-byte AES key and 16-byte CBC IV from the password and salt.
3. PKCS#7 padding → AES-256-CBCWhole blocks are encrypted. No authentication tag is produced.
4. Salted header + ciphertext → .encDecrypt reads the salt, derives the same key/IV, decrypts, then checks padding. Changed data can still pass.

Unlike SFV, a normal enc salted header is not a self-describing authenticated container: keep the exact OpenSSL version, cipher, KDF, iteration count, digest, salt length and whether Base64 was used with your backup, separately from the passphrase. Older files may use different derivation defaults. Do not guess parameters or downgrade to legacy algorithms; consult the creator’s recorded settings. Do not add manual -S salts or key/IV overrides: explicit-salt behavior changed in OpenSSL 3.0.

Every argument, explained.

General shape: openssl enc -CIPHER [-e | -d] [KDF options] -in INPUT -out OUTPUT. Brackets and uppercase placeholders here are notation, not characters to type. | in this notation means “choose one”; in a real shell command it pipes output into the next program.

Shell punctuation is part of the explanation, too.

Single quotes keep a path with spaces literal: './my document.pdf'. Replace the whole quoted filename with your own path; ./ denotes the current directory and avoids a leading dash being mistaken for an option. A literal apostrophe needs different shell quoting; do not paste an untrusted filename as shell syntax. Double quotes in "$workdir" expand the variable while keeping its path one argument. A backslash at the very end of a line joins it to the next line: no spaces after that backslash. You can instead put the entire command on one line without the backslash.

openssl enc -aes-256-cbc -e -pbkdf2 -iter 600000 -md sha256 -salt -a \
  -in './original.bin' -out './original.bin.enc.b64'

openssl enc -aes-256-cbc -d -pbkdf2 -iter 600000 -md sha256 -salt -a \
  -in './original.bin.enc.b64' -out './recovered-base64.bin'

To encrypt real text, save it to a private file using a trusted local editor, then encrypt that file. The public printf practice sample above is not a pattern for entering secrets. No secret-bearing pipe examples, passwords in arguments, obsolete ciphers, or disabled padding are needed.

A decrypted file is not automatically a trustworthy file.

“bad decrypt” / wrong passphrase

Usually wrong password/settings, truncated data, or invalid padding. OpenSSL may already have written partial or garbage plaintext before reporting failure. Do not use that output. A wrong password can also pass padding by chance; neither absence nor presence of this error is a reliable authenticity test.

Modified ciphertext, but no error

CBC is malleable: modifying a non-final ciphertext block can corrupt one plaintext block and deliberately flip bits in the next while leaving final padding valid. Our Linux regression test demonstrates an exit status of zero with changed plaintext. This is expected behavior, not proof that the file was safe.

“bad magic number” / “wrong final block length”

Check the source format, complete file transfer, recorded parameters and whether Base64 was used. These messages vary by version and do not reliably diagnose a particular cause. A browser .sfv file is simply the wrong format for enc.

Unknown option / missing algorithm

Read openssl version and openssl enc -help; check vendor documentation and provider configuration. Do not “fix” it with an older cipher or weaker KDF.

Permission denied / output exists

Check your directory and filenames without broadening permissions. Stop if a desired output already exists; choose a new name. Do not use root privileges just to encrypt your own file.

Keep the original until a trusted recovery test and backup succeed. We never recommend automatic deletion. Save encrypted output and its settings to storage you control; do not rely on the temporary practice directory. Move/backup deliberately, verify your copy, keep the passphrase separately, and restrict access to recovered plaintext. Moving to shared or non-POSIX filesystems may change permissions. Encryption does not erase originals, temporary plaintext, swap, shell history, editor backups, or saved downloads.

For important files, prefer an established authenticated file-encryption tool/format, or the browser’s authenticated SFV workflow within its documented limits. Do not build your own ad-hoc “CBC plus hash” scheme. This guide does not make the application externally audited; a compromised origin/browser/extension/device can still observe secrets. There is no browser execution of these terminal commands and no automatic clipboard use: Copy buttons copy only the displayed public example you choose.