AES-256-GCM encryption with PBKDF2 key derivation — runs entirely in your browser, nothing leaves your device.