Encrypt and decrypt confidential text with military-grade AES-256-GCM (250k PBKDF2 iterations) or compute SHA-256/SHA-512 checksums for local files.
Step-by-Step Client-Side Workflow
1. PBKDF2-SHA256 Key Derivation: Your passphrase is combined with a random 128-bit cryptographic salt and stretched through 250,000 PBKDF2-SHA256 iterations.
2. Authenticated AES-256-GCM Sealing: Plaintext is encrypted with a unique 96-bit initialization vector (IV) and an authentication tag that detects any tampering.
3. Local SHA-256 / SHA-512 Digest: Files and text strings are hashed directly in browser memory to verify software downloads and document integrity.
Why Use VaultTools Zero-Upload Architecture
True Zero-Knowledge Cryptography: Neither your passphrase nor your plaintext ever leaves your device. Even over untrusted chat channels, your armored ciphertext stays safe.
Tamper-Proof GCM Authentication: AES-GCM guarantees both confidentiality and integrity—if a single byte of ciphertext is altered, decryption immediately alerts you.
Instant Local File Checksums: Verify multi-megabyte installers or legal PDFs against published SHA-256 hashes without uploading files.
Frequently Asked Questions
Can VaultTools recover my encrypted text if I forget the passphrase?
No. Because encryption happens 100% in your browser using AES-256-GCM with no server or key escrow, there is no backdoor. Only someone with the exact passphrase can decrypt the payload.
Why does encrypting the same text twice produce different ciphertext?
Every encryption generates a brand-new random 16-byte salt and 12-byte IV via window.crypto.getRandomValues(), preventing rainbow-table and replay attacks.