Crypto math ·
Symmetric vs asymmetric in-browser encryption via WebCrypto
SubtleCrypto implements AES-GCM and RSA-OAEP in a secure context. AES-GCM is bulk encryption with a unique IV. RSA-OAEP encrypts small blobs such as wrapped AES keys. Password-based encryption needs a KDF (PBKDF2, Argon2) first. None of this should send plaintext to a server “to encrypt.”
AES-GCM parameters
key 128 or 256 bits, iv 96 bits recommended, additionalData optional, tagLength 128 default. Store iv with ciphertext (concatenate).
RSA-OAEP for wrap
generateKey RSA-OAEP SHA-256. Export public JWK to encrypt small keys. Private key non-extractable in IndexedDB if you must persist.
Passwords are not AES keys
PBKDF2 or Argon2id from the password tools, then importKey the derived bits. Low iterations are theater.
Extractable flags
extractable: false prevents exportKey of raw material. XSS can still use the key while the page is open. Zero-server reduces disk theft of your ciphertext database — not live XSS.
Honest product scope
This site’s hash and HMAC tools are the primitives. A full “encrypt my chat” product is a protocol (Signal, etc.), not a 20-line snippet.
Frequently asked questions
What happens if I reuse an AES-GCM IV with the same key?
Nonce reuse can reveal plaintext XOR and break authenticity. Generate 96 random bits per encryption.
Can I RSA-OAEP a whole PDF?
No. Size limits are the key size minus padding. Hybrid: AES-GCM the file, OAEP the AES key.
Is this a replacement for TLS?
No. It protects a payload at rest in localStorage or a downloaded file. The transport to our origin should still be HTTPS.