Is AES-256 actually strong?

Yes — genuinely. The marketing is silly, not the cipher.

Why does key derivation matter?

Because your passphrase is the weak link. Slow derivation makes brute-forcing weak passwords orders of magnitude more expensive.

Is 'zero-knowledge' meaningless?

No — it's a real term. It's just often used by services that also want you to give them your files, which is the tension.

Answers/The escape queries

File encryption for people who don't trust 'military-grade' marketing

'Military-grade encryption' means, at most, 'we use AES-256'. So does every browser, every phone, and every ZIP tool made in the last decade. The phrase is a tell that the marketing copy is doing more work than the engineering claims. Here is what to look for instead.

What actually matters on a product page

Which cipher and mode (AES-256-GCM and ChaCha20-Poly1305 are current defaults). Which key-derivation function and its cost (PBKDF2 with a high iteration count, Argon2id with sensible memory). Whether the client talks to any server. Whether the source is inspectable. Whether the vendor has an incentive-aligned end (open source, receivership, source escrow).

Smells to walk away from

'Military-grade' with no primitive named. 'Zero-knowledge' as the only cryptographic claim. Screenshots of soldiers or padlocks. A pricing page that talks about 'peace of mind' more than the key-derivation function. No mention of an audit or open-source status.

How Elba tries to be honest

AES-256-GCM, PBKDF2 with 600,000 iterations, WebCrypto in a Chromium browser. Source ships in the file — right-click, view source. Becomes open source on 1 January 2030 by license. Makes zero network calls; verify this yourself in DevTools.

Questions people actually ask

Is AES-256 actually strong?: Yes — genuinely. The marketing is silly, not the cipher.
Why does key derivation matter?: Because your passphrase is the weak link. Slow derivation makes brute-forcing weak passwords orders of magnitude more expensive.
Is 'zero-knowledge' meaningless?: No — it's a real term. It's just often used by services that also want you to give them your files, which is the tension.

Take the island

Elba is one HTML file. It runs locally in a Chromium browser, seals a folder with AES-256-GCM, never phones home, and becomes open source on 1 January 2030.

€49MMXXVI· now ·
€39MMXXVII2027
€29MMXXVIII2028
€19MMXXIX2029
FreeMMXXX2030

the price falls each year · free to all 1 jan 2030

Take the island — €49

pay once · no account · nothing leaves