Encryption protects contents; ZIP packaging does not
A normal ZIP groups files but does not provide confidentiality. OpenFileTools derives an AES-256-GCM key from your password and a random salt, then encrypts and authenticates the file bytes.
The versioned .oftenc envelope
The binary envelope starts with OFTENC1, a format version, PBKDF2 iteration count, random 16-byte salt, random 12-byte IV, UTF-8 original filename, and authenticated ciphertext. Metadata is authenticated so tampering or a wrong password fails instead of producing unchecked plaintext.
Encrypt and decrypt
In Encrypt mode choose a file, enter a strong unique password, and download the .oftenc result. In Decrypt mode choose that envelope and enter the same password; a successful authentication restores a separate download using the stored filename.
Password loss and backups
OpenFileTools never receives or stores the password and cannot reset it. Losing the password can make recovery impossible, so keep it in a reputable password manager and preserve tested backups of important data.
Privacy, limits, and common failures
Encryption and decryption happen in browser memory with a 200 MB limit. Wrong passwords, corruption, or modified authenticated metadata produce the same safe failure rather than revealing partial plaintext.
- Random salt and IV make repeated encryption outputs different.
- Do not rename an arbitrary file to .oftenc and expect it to decrypt.
- A strong password matters even with a robust cipher.