OpenCrypt Documentation

What is OpenCrypt?

OpenCrypt is an in-browser, client-side cryptographic workstation designed for encrypting individual files, multi-gigabyte datasets, nested folder structures, and sensitive text payloads.

All cryptographic operations are performed directly in your local hardware memory using the W3C standard Web Crypto API (window.crypto.subtle). OpenCrypt requires no software installations, operates without browser plugins, contains zero third-party tracking scripts, and communicates with no external server endpoints during the encryption or decryption lifecycle.

Core Principles

OpenCrypt was engineered around four foundational principles of modern operational security:

AES-256-GCM (Authenticated Encryption)

Advanced Encryption Standard (AES) with a 256-bit key provides 2²⁵⁶ potential key combinations, rendering brute-force decryption physically impossible with existing and foreseeable supercomputers.

OpenCrypt deploys AES in Galois/Counter Mode (GCM). GCM is an Authenticated Encryption with Associated Data (AEAD) mode that combines counter-mode encryption with Galois field multiplication (GF(2¹²⁸)) to compute a 128-bit Message Authentication Code (MAC) tag over the ciphertext.

Security Impact: Unlike unauthenticated modes (such as AES-CBC or AES-CTR without HMAC), GCM prevents bit-flipping and padding oracle attacks. If an adversary modifies even a single bit in the encrypted container, decryption fails immediately and unconditionally, aborting before corrupted data can be executed.

PBKDF2-HMAC-SHA256 (Key Derivation)

User passphrases vary widely in entropy and cannot be used directly as raw cryptographic keys. OpenCrypt utilizes PBKDF2 (Password-Based Key Derivation Function 2) parameterized with HMAC-SHA-256 to stretch the human-entered password into a 256-bit cryptographic key:

Key = PBKDF2(PRF=HMAC-SHA-256, Password=P, Salt=S[16 bytes], Iterations=600,000, Length=256 bits)

The 600,000 Iteration Threshold: Deriving a single key requires calculating HMAC-SHA-256 600,000 times in a chained feedback loop. While this takes only a fraction of a second on a modern user CPU, it forces an attacker attempting to crack a stolen container to perform hundreds of thousands of hashing operations per guess, multiplying the financial and computational cost of brute-force attacks by several orders of magnitude.

16-Byte Cryptographic Salt: For each encryption operation, OpenCrypt generates a fresh 16-byte random salt via CSPRNG. This ensures that even if two users choose identical passphrases, their derived keys and resulting ciphertexts will be completely different, nullifying precomputed rainbow tables.

Pre-Encryption Compression (Deflate)

Plaintext data (such as code, JSON, logs, spreadsheets, and documents) frequently exhibits high redundancy and predictable frequency distributions.

When compression is enabled, OpenCrypt compresses the plaintext using the Deflate algorithm (RFC 1951) prior to ciphering.

File & Folder Workflow

Advanced Option: Large File Streaming Architecture

Standard in-memory web encryption loads the entire file into a single contiguous JavaScript ArrayBuffer. When processing multi-gigabyte files, this causes catastrophic browser memory spikes and crashes the tab due to heap limits.

OpenCrypt solves this with a Streaming Pipeline (1 MiB default, up to 64 MiB maximum chunk size) using deterministic counter nonce derivation and cryptographic Associated Authenticated Data (AAD) binding:

Advanced Option: Pre-Encryption Compression

When encrypting uncompressed formats (e.g., CSV databases, log files, text archives, SQL dumps, or software source trees), enabling Pre-Encryption Compression invokes raw Deflate compression on the payload stream before ciphering.

This delivers substantial container size reductions without sacrificing encryption throughput, while automatically bypassing pre-compressed files (like JPEG or MP4) where compression yields no benefit.

Advanced Option: Signature Obfuscation (Stealth Containers)

Standard encrypted archives carry fixed, recognizable magic byte signatures (for example, the ASCII sequence OCPT at offset 0). Firewalls, network monitors, and Deep Packet Inspection (DPI) scanners search for these magic bytes to identify, flag, or quarantine encrypted containers.

When Signature Obfuscation is enabled:

• The static OCPT magic header is stripped and replaced with pseudo-random high-entropy bytes.
• Container format markers are randomized and structurally blended across the cryptographic salt and IV.
• The resulting output file resembles a completely random stream of uniform binary entropy, indistinguishable from white noise or hardware random numbers.

Text Encryption Workflow

Simply paste or type your sensitive note into the input textarea, enter your chosen passphrase, and click Encrypt Text. OpenCrypt derives a 256-bit AES key via PBKDF2, seals the text with AES-256-GCM, and produces an armored string with one-click copy and download options.

To decrypt, paste the armored string into the input box, supply the original passphrase, and click Decrypt Text to recover the exact original plaintext.

Armored Format (OCPT_...)

Binary ciphertexts cannot be safely transmitted through messaging apps (e.g., WhatsApp, Signal, Telegram, Discord), web forums, or email without risking character corruption caused by Unicode encoding, line breaks, or whitespace normalization.

OpenCrypt encodes ciphertexts into a robust Base64URL armored envelope prefixed with OCPT_:

OCPT_AQAAk1oW1r4_kL90Q0b3x8xM8hQ4wN7vC9p_3K2yL6jR5mT1xYz8vB4wQ...

Binary Armoring Layout: The base64url payload packs the container flags, 16-byte PBKDF2 salt, 12-byte GCM nonce, 128-bit authentication tag, and the encrypted ciphertext into a single URL-safe string using only [A-Za-z0-9-_=].

Text Signature Obfuscation

When Signature Obfuscation is enabled in the Text module, the explicit OCPT_ prefix and version markers are removed. The output becomes a pure, non-prefixed high-entropy base64 string, preventing signature-matching chat filters and automated text scrapers from identifying the message as an OpenCrypt payload.

Text Pre-Encryption Compression

Enabling compression in the Text module compresses extensive text documents (such as JSON config trees, database exports, private keys, or lengthy markdown documentation) using Deflate prior to encryption. This can reduce the resulting armored string length by 50% to 80%, making it far easier to share across platforms with strict message length limits.

Memory Management & Web Workers

Browser main threads are shared with UI rendering and user interactions. Executing PBKDF2 with 600,000 iterations or streaming gigabytes of data on the main thread would cause catastrophic UI freezing and trigger browser "Page Unresponsive" warnings.

OpenCrypt offloads all computationally intensive tasks to a dedicated background Web Worker:

• Thread Isolation: Hashing, compression, and AES encryption execute on separate OS threads without blocking UI animations or button states.
• Transferable ArrayBuffers: Data buffers are transferred between the main thread and the worker using zero-copy postMessage(buffer, [buffer]) semantics, avoiding redundant memory cloning.
• Zero Disk Caching: All intermediate data chunks are discarded from RAM as soon as they are processed, ensuring no residual plaintext lingers in persistent browser storage.

Security & Threat Model

Container Binary Layout

OpenCrypt employs deterministic binary container layouts for both standard and stealth operational modes, validated with Authenticated Associated Data (AAD) binding:

1. Standard File Container (.opencrypt — 44 + M Bytes Header)

2. Text Armored Envelope Layout (34 Bytes Header + Ciphertext)

Prior to Base64URL encoding (with OCPT_ prefix), text ciphertexts are packed into a compact 34-byte binary envelope:

3. Stealth / Obfuscated File Container (55 + M Bytes Header)

Open Source & License

OpenCrypt is free software distributed under the terms of the GNU Affero General Public License v3.0 (AGPL-3.0).

Under the AGPL-3.0 license, you are free to inspect, audit, modify, and self-host OpenCrypt on private internal networks or air-gapped hardware. Any modifications or deployments made available over computer networks must make their corresponding source code publicly available under the same license terms.