AES-GCM Encryption

What AES-GCM actually guarantees

This tool uses AES in Galois/Counter Mode — the same authenticated-encryption scheme standardised in NIST SP 800-38D and used by TLS, SSH and disk encryption. 'Authenticated' is the part that matters: GCM does not just scramble your data, it also produces a 128-bit authentication tag. On decryption, if a single bit of the ciphertext, the nonce or the associated data has been altered, the tag check fails and you get an error instead of garbage. An attacker cannot flip bytes to silently corrupt your file or forge a valid ciphertext.

Under the hood the browser's Web Crypto API derives a key from your passphrase, generates a fresh random 96-bit nonce (initialisation vector) for every encryption, and encrypts in counter mode. The nonce is stored alongside the ciphertext — it is not secret, but it must never repeat under the same key, which is why the tool generates a new one each time rather than letting you pick it. Reusing a nonce with GCM is catastrophic: it can leak the XOR of two plaintexts and, worse, expose the authentication key itself.

Why the passphrase and its KDF do the real work

AES-256 is not the weak link — your passphrase is. A key derivation function (KDF) such as PBKDF2 or Argon2 stretches a human passphrase into a full-length key by hashing it tens or hundreds of thousands of times with a random salt. The salt stops precomputed rainbow tables; the iteration count makes each password guess expensive. With a fast unsalted hash an attacker tests billions of guesses per second on a GPU; with a properly tuned KDF that same hardware manages only thousands. That gap is the entire margin of safety for a passphrase-encrypted file.

The practical consequence: a four-word dictionary passphrase behind PBKDF2 is far stronger than 'P@ssw0rd!' behind the same KDF, because the attacker's cost scales with how unpredictable your input is, not how many symbol classes it contains. Generate one with the Password generator, and if you are unsure how much randomness you actually have, run it through the Password strength meter. The deeper mechanics are walked through in AES-GCM encryption explained.

Lose the password, lose the data — there is no recovery

This is symmetric encryption with no escrow, no backdoor and no 'forgot password' link, by design. The key exists only as something derived from your passphrase at the moment you type it; it is never written down, never transmitted, never stored. If you forget the passphrase, the ciphertext is mathematically indistinguishable from random noise and no one — including us — can recover it. That property is exactly why the tool is safe for sensitive material, and exactly why a lost passphrase is final.

Treat the passphrase as the asset, not the file. Store it in a password manager, write it on paper in a safe, or split it among trusted parties — but never email the encrypted file and its passphrase in the same thread, which hands both halves to anyone who reads either message. For long-term archives, test that you can decrypt the file today, before you rely on recovering it in five years.

GCM vs CBC, and what this tool deliberately isn't

The older AES-CBC mode only provides confidentiality — it hides the contents but does nothing to detect tampering. CBC has been the source of an entire family of real-world breaks (padding-oracle attacks like POODLE and Lucky Thirteen) precisely because the receiver decrypts attacker-controlled ciphertext before checking integrity. GCM closes that door by verifying the tag first. Unless you have a specific reason to do otherwise, authenticated modes like GCM are the modern default.

• This is not a password manager or a secure messenger — it encrypts a blob you control, it does not manage keys or identities for you.
• It does not protect a file already open on a compromised machine: encryption guards data at rest and in transit, not a device with malware reading your screen.
• It is not steganography — an encrypted file looks encrypted. It hides the contents, not the fact that something is hidden.
• Encrypting an already-compressed file (JPEG, MP4, ZIP) will not shrink it; ciphertext is incompressible, so compress before you encrypt, never after.

CBC is not broken as a cipher, but it must be paired with a separate authentication step to be safe — GCM bundles both.