Which encryption does this tool use?
Version 1 packages use AES-256-GCM authenticated encryption. A 256-bit key is derived from the passphrase with PBKDF2-HMAC-SHA-256, a random salt, and 600,000 iterations.
Encrypt text or files with a passphrase, then decrypt authenticated packages when needed.
Workspace
AES-256-GCM protects confidentiality and detects package changes.
EBURPENC version 1 uses a random 16-byte salt, PBKDF2-HMAC-SHA-256 with 600,000 iterations, a random 12-byte nonce, and AES-256-GCM with a 128-bit authentication tag. The fixed header is authenticated as additional data. Filename, file type, and content are encrypted together.
Version 1 packages use AES-256-GCM authenticated encryption. A 256-bit key is derived from the passphrase with PBKDF2-HMAC-SHA-256, a random salt, and 600,000 iterations.
AES-GCM both encrypts the content and detects changes. Decryption fails if the passphrase is wrong or the authenticated package has been altered.
No. There is no account, recovery key, or back door. Keep the passphrase somewhere safe and separate from the encrypted package.
Yes. The same passphrase-derived secret key is required for encryption and decryption. Anyone with the package and passphrase can recover its contents.
Yes. For file packages, the original filename and MIME type are inside the authenticated ciphertext rather than the visible package header.