ToolDock encrypted file format v1 (TDENC001)

Binary envelope, all integers unsigned big endian:
  offset 0: 8 ASCII bytes TDENC001 (format version 1)
  offset 8: uint32 PBKDF2 iteration count; must equal 600000 in v1
  offset 12: 16 random salt bytes
  offset 28: 12 random AES-GCM nonce bytes
  offset 40: AES-256-GCM ciphertext followed by its 16-byte authentication tag

All 40 header bytes are authenticated as GCM additionalData. The password is exact UTF-8 (no trimming or normalization), 12-1024 JS string characters for encryption; decryption accepts 1-1024. PBKDF2-HMAC-SHA-256 derives a non-extractable AES-256 key with 600000 iterations. Each encryption uses crypto.getRandomValues for a new salt and nonce. No key reuse or custom cipher is used.

The encrypted plaintext is uint32 JSON byte length, UTF-8 JSON {name,type}, then original file bytes. Metadata is limited to 4096 bytes. User filenames are sanitized for download. Decrypted outputs always use application/octet-stream and are not previewed or executed. Decryption authenticates the entire ciphertext before any file is released. A wrong password and altered ciphertext produce the same error. Unknown format versions, malformed headers, invalid KDF parameters, size limits and invalid authenticated metadata are rejected. Header validation precedes key derivation; attacker-controlled iteration counts cannot trigger excessive KDF work.

The tool uses Web Crypto in a disposable dedicated worker. Cancel, clear or leaving the page terminates it. Password fields are cleared on start and are never put in URLs, logs, analytics, localStorage, IndexedDB or network requests. File inputs, output Blob URLs and browser download history still exist on the device until cleared; browser/OS memory cannot be guaranteed securely erased. A download persists to the user's disk. Password managers or extensions may access fields independently of this application.

Whole-file encryption/decryption, not streaming: 50 MiB plaintext maximum, plus the bounded envelope. Multiple buffers can coexist in memory. Low-memory devices can fail even within this limit. Requires secure context (HTTPS or localhost), Web Crypto, workers and modern browser downloads. No account, server recovery key or password recovery exists. Use a long, unique passphrase and verify decryption before deleting originals. AES-GCM does not prevent someone replacing the entire file with a different valid file for the same password. No origin authenticity or malware scan is provided.

Not independently security-audited. Device compromise, malicious browser extensions, weak passwords, side channels and future cryptographic changes remain outside this guarantee. No claim of formal certification, secure deletion, or recovery is made.

Design references:
https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/encrypt
https://developer.mozilla.org/en-US/docs/Web/API/AesGcmParams
https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html