In-Browser AES-256-GCM Encryption & RSA-PSS Digital Signature Studio (2026)

AES-CBC provides confidentiality only and is vulnerable to Padding Oracle attacks (such as POODLE and Lucky13) if not paired with a separate Encrypt-then-MAC (HMAC) construction. AES-256-GCM is an Authenticated Encryption with Associated Data (AEAD) cipher that combines Counter (CTR) mode encryption with a 128-bit Galois field authentication tag (GMAC), guaranteeing both confidentiality and integrity simultaneously.

In AES-GCM, reusing the exact same 96-bit nonce with the same 256-bit key results in a 'nonce reuse catastrophe': an attacker can XOR the two ciphertexts together to cancel out the AES keystream, immediately recovering the XOR of the two plaintexts and forging valid GMAC authentication tags for future messages.

Human passphrases do not have 256 bits of raw entropy. PBKDF2 combines the passphrase with a unique 128-bit random salt (defeating precomputed rainbow tables) and applies HMAC-SHA256 hundreds of thousands of times, multiplying the computational cost required for an attacker to test each password guess.

Asymmetric algorithms like RSA are mathematically slow and limited in payload size. PGP uses a hybrid cryptosystem: it generates a random one-time 256-bit session key, encrypts the large message body rapidly with AES-256 using that session key, and then encrypts only the tiny 256-bit session key using the recipient's RSA or Curve25519 public key.

No. This tool invokes `window.crypto.subtle` directly inside your browser tab. All key material resides exclusively in local volatile RAM and is cleared as soon as you close or refresh the page.