Client-Side Encrypted Secrets Container

César Caldeira

Client-Side Encrypted Secrets Container

How to protect sensitive documentation and confidential notes using browser-native PBKDF2 key derivation and AES-256-GCM encryption.

Author: César Caldeira

Published: Aug 24, 2026

Read Time: 1 min

This document is protected with AES-256-GCM and derived via PBKDF2 (100,000 SHA-256 iterations). Enter the authorized password to decrypt the contents directly in your browser.

The content of this document is encrypted at build time into an AES-256-GCM ciphertext payload with a unique salt and initialization vector (IV). It is decrypted strictly inside client memory upon password entry (carbon-secret-token).

Confidential Technical Architecture Notes

Zero Plaintext Leakage: The static HTML contains only base64 ciphertext; plaintext is never written to public HTML or server logs.
Web Crypto API: Decryption executes via standard browser window.crypto.subtle APIs with zero external cryptographic dependencies.
Session Memory: Decrypted content remains in client memory for the session duration and clears immediately upon page navigation.

Password-Protected Page

Confidential Technical Architecture Notes