Why encrypt files in the browser?

Emailing a sensitive document or storing it in the cloud exposes it to whoever runs the server. NearSeal encrypts files locally with a key derived from your passphrase — the default NearSeal format uses AES-256-GCM (PBKDF2), or choose the age format, the open age-encryption.org standard (scrypt + ChaCha20-Poly1305), so the file opens with any age-compatible tool, not just this site. Nothing is sent to a server and no account is required.

How NearSeal works

1. Pick one or more files and enter a passphrase — at least 8 characters, typed twice so a typo can’t lock you out.
2. Your browser derives a 256-bit encryption key from that passphrase. The NearSeal format runs PBKDF2-SHA256 for 1,048,576 iterations with a fresh random salt for every file; the age format derives its key with scrypt instead.
3. The file is sealed on your device: AES-256-GCM in the NearSeal format (the header — including the original filename — is authenticated too, so any tampering makes decryption fail loudly), or ChaCha20-Poly1305 in the age format.
4. You download the sealed .nearseal or .age file. To decrypt, drop a sealed file back onto this page — the format is detected from the file’s actual bytes, so it still works if the file was renamed.

NearSeal format or age format — which should you pick?

The NearSeal format is the fast default: AES-256-GCM with a PBKDF2-derived key, and the original filename travels inside the sealed container, protected against tampering. Its trade-off is that only this site can open it. The age format is the open age-encryption.org standard: it can be slower and it does not store the filename, but the sealed file opens with the age or rage command-line tools and any other age-compatible software — a better fit for long-term archives, or for sending to someone who prefers their own tools. Rule of thumb: sealing for yourself, for now — NearSeal; sealing for years, or for someone else’s toolchain — age.

“No upload” and “no recovery” are two sides of the same design. Because your file and passphrase never reach a server, there is no account, no reset email, and no support desk that could restore access — the passphrase you chose is the only key that exists. That is the honest limitation of a tool that never sees your data: NearSeal cannot recover a lost passphrase, cannot share or escrow keys, and keeps no cloud copy of anything. Store the passphrase in a password manager, or write it down somewhere safe, before you delete the original file.

Frequently asked questions