Memory-Hard Encryption in Browser
AES-256-GCM encrypts the text and authenticates both the encrypted data and its format metadata. A wrong password or any modification causes decryption to fail.
New ciphertext uses Argon2id to derive the AES key. Argon2id is memory-hard, making large-scale password guessing more expensive than fast password hashes. A strong, unique passphrase is still essential.
New output uses the versioned FSE2 format with Argon2id (time cost 10, memory 64 MiB, parallelism 1), a fresh 16-byte salt, a fresh 12-byte AES-GCM IV, and an authenticated header. The Argon2 dependency is pinned to version 1.18.0 and protected by SHA-384 Subresource Integrity.
This page can decrypt its older unversioned output. Due to an API-name mismatch in the earlier page, that output used Argon2d even though the interface said Argon2id. After opening legacy data, encrypt it again to upgrade it to FSE2 and genuine Argon2id.
Encryption runs locally and plaintext is not sent to a server. However, a compromised device, browser extension, GitHub account, or deployed page could capture secrets while the page is open. For high-value SSH keys and passwords, prefer an audited password manager and hardware-backed SSH keys.