How Zero-knowledge file encryptor & self-decrypting envelope Works Locally in Your Browser
PrivacyFold's Zero-Knowledge File Encryptor uses native WebCrypto AES-256-GCM and 600,000-iteration PBKDF2 to seal files into portable self-decrypting HTML packages. Encryption and decryption occur entirely offline without transmitting passphrases or ciphertext to any server.
When sharing sensitive financial statements, tax filings, legal contracts, or confidential identity documents, traditional cloud file-sharing services store your data unencrypted on their servers or hold the master decryption keys. PrivacyFold's Zero-Knowledge File Encryptor implements military-grade AES-256-GCM symmetric encryption combined with PBKDF2 key derivation using 600,000 SHA-256 iterations directly inside your browser via the W3C Web Cryptography API. Rather than requiring recipients to install proprietary decryption software, the tool packages your encrypted payload into a self-decrypting HTML envelope. Any recipient with the correct passphrase can open the HTML file in any modern web browser on Windows, macOS, Linux, iOS, or Android, enter the password, and decrypt the original file with zero software installations and zero network requests.
Step-by-Step Instructions
- Select or drag the sensitive document, spreadsheet, PDF, or image you wish to protect.
- Enter a strong passphrase or generate a cryptographically random 128-bit key.
- The WebCrypto engine generates a unique 96-bit cryptographic initialization vector (IV) and 128-bit salt.
- Your file is encrypted in memory with authenticated AES-GCM, producing ciphertext with an integrity authentication tag.
- Download the resulting self-decrypting HTML file and share it securely via email, USB drive, or messaging apps.
Settings Explained & Safe Configurations
Input password used to derive the 256-bit AES master key via PBKDF2. Longer passphrases drastically increase resistance to dictionary attacks.
User-specified or generated high-entropy string · Example: Use 4 random words (e.g. "correct-horse-battery-staple") for optimal security.Determines the computational work required to test passwords. PrivacyFold enforces 600,000 iterations per OWASP 2026 security benchmarks.
600,000 iterations · Example: Makes brute-force dictionary cracking infeasible even on high-end GPUs.Optional unencrypted title displayed on the decryption screen to guide the recipient without revealing confidential file details.
Confidential Document Envelope · Example: "Q4 Board Financials — Enter agreed boardroom passphrase".What to Expect & Performance Benchmarks
A self-contained .html file containing base64-encoded AES-256-GCM ciphertext, 12-byte IV, 16-byte salt, and an inline clean decryption portal.
Privacy Verification & Technical Guarantee
Uses window.crypto.subtle.deriveKey() with PBKDF2 and window.crypto.subtle.encrypt() with AES-GCM. No external cryptographic libraries are imported.
- Open DevTools Network tab.
- Encrypt a test document with a passphrase.
- Observe zero network requests.
- Open the generated HTML envelope in a new private browser tab with Wi-Fi disabled: verify full offline decryption capability.
Auditable, zero-dependency implementation conforming to W3C Web Cryptography API and NIST SP 800-38D.
Architecture & Standards Comparison
| Attribute | PrivacyFold Local Engine | Traditional Online Converters |
|---|---|---|
| Execution Runtime | /wasm/crypto/file-encrypt-v1.wasm (In-Browser RAM) | Remote Cloud Server Buckets |
| Standard Compliance | W3C WebAssembly Core 2.0 | Opaque Server Scripts |
| Network Footprint | 0 KB uploaded (Client-Side Only) | Full File Upload Over Internet |
| Offline Support | 100% Functional via Service Worker PWA | Fails Without Active Server Connection |
| Agent Integration | Deterministic JSON-RPC / MCP Tool Schema | Ad-Hoc REST Upload Form |
Frequently Asked Questions
How does the recipient decrypt the file if they do not have PrivacyFold installed?
The output is a standard HTML document containing the encrypted ciphertext and a minimal offline WebCrypto decryption script. The recipient simply double-clicks the HTML file in any browser (Chrome, Safari, Edge, Firefox), types the password, and the browser decrypts and saves the original file to their device.
Can PrivacyFold or any government agency recover my file if I lose my password?
No. This is a true zero-knowledge cryptographic implementation. Your passphrase never leaves your device's volatile memory, and we possess no master keys or backdoors. If you lose your password, the ciphertext is mathematically unrecoverable.
Why is AES-256-GCM with PBKDF2 considered the gold standard for file security?
AES-256-GCM provides both strong confidentiality and cryptographic authenticity (tamper-proofing). If anyone attempts to alter even a single bit of the encrypted file, decryption fails with an authentication error. PBKDF2 with 600,000 iterations protects against brute-force and GPU dictionary attacks.
Does the self-decrypting HTML file connect to the internet to decrypt?
No. The self-decrypting HTML file contains 100% self-contained vanilla JavaScript that uses the recipient browser's native window.crypto.subtle engine. It functions flawlessly with airplane mode enabled and network cables disconnected.
What is the maximum file size I can encrypt into a self-decrypting envelope?
Most modern browsers comfortably handle files up to 250 MB into an HTML envelope. For files larger than 500 MB, we recommend dedicated offline archives.
Can I encrypt multiple files into a single encrypted envelope?
Yes. You can bundle multiple files into a single zip archive and encrypt the resulting zip file into the HTML envelope.