seal

lock files and messages with a password. everything happens in this tab; nothing is uploaded

password

used to seal and to open. lose it and the data is gone.

type a password or generate a passphrase

⌘enter run · g generate · [] switch

drop files to seal or click to choose (each becomes its own .seal file)

or type a message

message to encrypt

output is a text block or a link you can paste into any chat

how it works (format v1)

key      PBKDF2-SHA256, 600,000 iterations, random 16-byte salt -> AES-256 key
cipher   AES-256-GCM, 1 MiB chunks, random 12-byte base IV
         chunk i uses iv = base IV with its last 4 bytes xor i
         every chunk authenticates the header + its index + a final flag,
         so reordering, truncation and edits are all detected

layout   "SEAL"  u8 version  u32 iterations  u32 chunk size
         16-byte salt  12-byte IV                       (41-byte header)
         u32 length + encrypted {name, mime, size}       (record 0)
         encrypted chunks, each chunk size + 16-byte tag (records 1..n)

text     the same container, base64, wrapped at 64 columns between
         -----BEGIN SEAL MESSAGE----- and -----END SEAL MESSAGE-----

the filename and type are inside the encryption, not visible on the outside.
files are processed in 1 MiB chunks. over 256 MB, chromium browsers can stream
the output straight to disk, so size is bounded by disk, not memory; elsewhere
the output is assembled in memory.