Secure Note + Tools

This is a simple HTML-based utility for encrypting/decrypting notes and performing basic text manipulation. It runs entirely in your browser using the Web Crypto API for encryption.

Features

• Encrypt: Securely encrypt messages using AES-GCM with a password.
• Decrypt: Decrypt messages that were previously encrypted using this tool.
• Replace Characters: Swap all occurrences of one character with another within a given text.

How to Use

1. Save the index.html file.
2. Open the index.html file in your web browser.
3. Alternatively, access the live demo at securenote.asanchez.dev.
4. Use the tabs at the top to switch between the different tools: Encrypt, Decrypt, and Replace Characters.

Encrypt

1. Go to the "Encrypt" tab.
2. Enter the message you want to encrypt in the text area.
3. Enter a strong password in the password field.
4. Click the "Encrypt" button.
5. The encrypted message (a base64 encoded string) will appear in the output box below. Copy this text to save or share it.
6. The password field is cleared automatically. Use "Clear" to wipe the message and output as well.

Decrypt

1. Go to the "Decrypt" tab.
2. Paste the previously encrypted message (the base64 string) into the text area.
3. Enter the exact same password used for encryption.
4. Click the "Decrypt" button.
5. The original message will appear in the output box. If the password is incorrect or the data is corrupted, an error message will be shown.

Replace Characters

1. Go to the "Replace Characters" tab.
2. Enter the text you want to modify in the text area.
3. Enter the single character you want to replace in the "From" field.
4. Enter the single character you want to replace it with in the "To" field.
5. Click the "Replace" button.
6. The modified text will appear in the output box.

Security Notes

• Client-Side Operation: This tool runs entirely in your web browser. No data, including your messages or passwords, is ever sent to any external server. All processing happens locally on your machine.
• Enforced by Content Security Policy: The page carries a Content-Security-Policy of default-src 'none' with hash pinning for its own inline script and style, plus form-action 'none' and base-uri 'none'. The browser therefore blocks every outbound connection and refuses to run any script other than the one whose hash is pinned, even if the hosting or a browser extension tried to inject one.
• Strong Encryption: Encryption uses the standard Web Crypto API, specifically AES-GCM with a 256-bit key, which is a widely recognized and secure authenticated encryption algorithm. The key is derived from your password using PBKDF2-HMAC-SHA-256 with 600,000 iterations (the current OWASP recommendation) and a random 16-byte salt per message.
• Authenticated Header: The message header (format version, iteration count, salt, IV) is bound to the ciphertext as AES-GCM additional data, so it cannot be altered without the decryption failing. Iteration counts outside 100,000–5,000,000 are rejected before any key derivation, so a crafted message cannot hang your browser.
• Privacy Hygiene: Sensitive fields disable spellcheck, autocorrect, and autocomplete, so browser features such as cloud spellcheck or the password manager never see your text or passphrase. Password fields are cleared after each operation, and every tab has a "Clear" button.
• Password Security: The security of your encrypted message relies heavily on the strength of your password. Use a long, complex, and unique password. Passwords are Unicode-normalized (NFC) before key derivation so the same passphrase works across operating systems.
• No Recovery: If you forget your password, there is absolutely no way to recover the encrypted message. Store your password securely.

Message Format

Encrypted output is the base64 encoding of:

version (1 byte, 0x02) | PBKDF2 iterations (4 bytes, big-endian) | salt (16) | IV (12) | AES-GCM ciphertext + tag

Messages created by earlier versions of this tool (base64-encoded JSON with 100,000 iterations) are still recognized and decrypt normally.

Hosting Recommendations

A few protections can only come from HTTP response headers, not from the page itself. If you host index.html yourself, add:

Content-Security-Policy: frame-ancestors 'none'
Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-store
X-Content-Type-Options: nosniff

Development

There are no dependencies. Tests run on Node 20+ with the built-in test runner:

node --test 'tests/**/*.test.mjs'

The tests load the page's inline script, round-trip messages, decrypt a fixture created by the legacy format, and verify that the CSP hashes match the inline code. After editing anything inside the <script> or <style> blocks, regenerate the hashes or the browser will refuse to run the page:

./scripts/update-csp.sh