Guides/Cryptography
Why WebCrypto is the boring, correct place to encrypt files
The safest cryptography is the one nobody has to write twice. WebCrypto is the standard, audited encryption library built into every modern browser — hardware-accelerated, side-channel-resistant, and reviewed by the people who ship the browsers themselves.
What Elba does not do
Elba does not include its own AES implementation. It does not include its own random-number generator. It does not include its own key-derivation code. Every one of those calls goes to the browser's SubtleCrypto API.
What we take responsibility for
We take responsibility for calling those primitives correctly, choosing a sane mode (AES-256-GCM), a sane derivation (PBKDF2 with per-vault salt), and never persisting the key. That code is inside the HTML file for you to read.
Questions people actually ask
- Which browsers count?
- Chromium-family browsers (Chrome, Edge, Brave, Arc) and Firefox all ship a full WebCrypto. Elba targets Chromium for the file-system access it needs.
- Is WebCrypto really as good as a native library?
- For AES-GCM it is a thin wrapper over the same primitives OpenSSL uses. It's the same crypto, in a smaller box.
Take the island
Elba is one HTML file. It runs locally in a Chromium browser, seals a folder with AES-256-GCM, never phones home, and becomes open source on 1 January 2030.
- €49MMXXVI· now ·
- €39MMXXVII2027
- €29MMXXVIII2028
- €19MMXXIX2029
- FreeMMXXX2030
the price falls each year · free to all 1 jan 2030
pay once · no account · nothing leavesRelated guides
- AES-256-GCM, explained without a maths degree
AES-256-GCM in one page — what it is, why Elba uses it, and what it does and doesn't protect against.
- How client-side encryption works, in one page
Client-side encryption means the key never leaves your device. Here's how it works, why it matters, and how Elba applies it.