Sending confidential passwords, private keys, or sensitive financial data across unencrypted messaging channels exposes you to surveillance. OmniTool Hub enables zero-knowledge, in-browser AES-256-GCM authenticated encryption that generates an uncrackable ciphertext bundle containing an Initialization Vector (IV), PBKDF2 salt, and authentication tag.
Key Property Parameters & Specifications
| Component | Size / Bit Length | Cryptographic Purpose |
|---|---|---|
| AES Key | 256 bits (32 bytes) | Symmetric cipher key derived via PBKDF2 from your master passphrase |
| PBKDF2 Salt | 128 bits (16 bytes) | Random salt preventing pre-computed rainbow table dictionary attacks |
| Initialization Vector (IV) | 96 bits (12 bytes) | Unique nonce ensuring identical plaintexts produce completely different ciphertexts |
| Authentication Tag (Auth Tag) | 128 bits (16 bytes) | Cryptographic checksum guaranteeing ciphertext was not tampered with or modified |
Implementation Guide & Technical Reference
AES-256-GCM Web Crypto API Flow
// Derive key via PBKDF2 and encrypt
const key = await crypto.subtle.deriveKey(
{ name: 'PBKDF2', salt, iterations: 100000, hash: 'SHA-256' },
passKey, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']
);
const ciphertext = await crypto.subtle.encrypt(
{ name: 'AES-GCM', iv }, key, new TextEncoder().encode(plaintext)
);Authenticated browser encryption.
Frequently Asked Questions (FAQ)
Why is AES-GCM superior to older AES-CBC mode?
AES-GCM is an Authenticated Encryption cipher that prevents bit-flipping and padding oracle attacks. If an attacker modifies even 1 bit of the ciphertext, decryption aborts with an authentication failure.
Can anyone intercept or decrypt my data on the internet?
No. The encryption executes entirely on your device before transmission. Without your secret master passphrase, AES-256 is computationally impossible to break.
How many PBKDF2 iterations are used to protect the password?
The engine applies 100,000+ PBKDF2 iterations with SHA-256 to thwart high-speed GPU brute-forcing attempts.
Can I encrypt binary files like PDFs or images?
Yes. File mode converts arbitrary binary streams into encrypted `.enc` payload files.