CryptoVault · hybrid encryption in one file

Your fingerprint. When someone adds you, they should compare it with you over a channel you trust (in person, a call):

The backup holds your private keys, encrypted with your passphrase (PBKDF2, 600,000 rounds, then AES-256-GCM). Without the passphrase it's noise; without the backup, a lost identity is gone for good.

Paste their public ID

It starts with CVID2:. Check the fingerprint it shows against theirs before you trust it: a swapped key is the classic attack.

Contacts are public keys only, kept in this browser so you don't have to paste them again.

For

Paste a message or open a file

identity

RSA-4096-OAEP (SHA-512) to receive · ECDSA P-256 (SHA-256) to sign

fingerprint

SHA-256 over both public keys (SPKI), first 128 bits shown

per message

a fresh AES-256-GCM key and a 96-bit random IV, used once

key wrap

the AES key, encrypted to the recipient's RSA key

header

"CV" · version 2 · flags · recipient's short fingerprint · wrapped key, all authenticated as GCM additional data

signature

sign, then encrypt: the signature covers the recipient and the content, and travels inside the ciphertext, so only the recipient learns who signed

files

name and type go inside the ciphertext too

backup

private keys (PKCS#8) under AES-256-GCM, keyed by PBKDF2-SHA-256 with 600,000 rounds and a random salt

network

none: the page's Content-Security-Policy forbids every connection, so even a bug can't phone home

This is a readable, working use of the browser's own cryptography, not audited software.

Key exchange is still the hard part: compare fingerprints with people before trusting them. Served over a network, the page is only as trustworthy as whoever serves it; save it and run it locally if that matters. There's no forward secrecy: if your private key and backup passphrase leak, past messages to you can be opened.

For anything that genuinely matters, use age, GPG or Signal.