Encrypt a message to paste anywhere CIPHER

What is actually happening to your message

Both modes end in AES-256-GCM, which is the encryption the browser itself ships and the same primitive that protects the connection you are reading this over. What differs is how the key for it is arrived at.

• Passphrase mode stretches what you typed with PBKDF2-SHA256 over 310,000 iterations against sixteen random bytes of salt, and uses the result as the key. The iteration count is written into the message, so a message made today still opens if the number is raised later.
• Key-pair mode generates a fresh ECDH key pair on the P-256 curve for every single message, agrees a shared secret with the recipient's public key, and runs it through HKDF-SHA256 to get the key. The ephemeral public key travels with the message; the ephemeral private key is discarded the moment it has been used.

The output is base64 wrapped in an armour block, so it survives being pasted into a mail client, a chat window, a ticket, or a text field that would otherwise mangle it. GCM authenticates as well as encrypts: a message that has been altered by so much as one character fails to open rather than opening as plausible nonsense, so you find out.

The passphrase is the weak part, and nothing here changes that

Nobody attacks AES-256. They attack the passphrase, by guessing, and the only question is how many guesses per second they get. Those 310,000 iterations are what make each guess expensive: they turn a few billion attempts a second into a few thousand. That is an enormous improvement and it is not a substitute for a passphrase worth guessing against.

Four or five unrelated words chosen at random beat one memorable word with letters swapped for digits, by an amount that is hard to overstate: the swaps are in every cracking dictionary and have been for twenty years. The strength meter on this page is an estimate of that, not a guarantee.

And then there is the question the mathematics cannot answer: how the passphrase reaches the other person. Sending it in the same channel as the message means an attacker who has the channel has both, and you have achieved nothing. Say it on the phone, hand it over in person, or use key-pair mode, which exists precisely so there is no shared secret to transport.

What it hides, and what it does not

The armour block is visibly an encrypted message. Anyone who sees it knows that you sent something, to whom, at what time, roughly how long it was, and which mode you used. If the fact of the communication is the sensitive part, encryption of the content does not help you; that is a different problem with different answers.

Key-pair mode does not prove who sent a message. Your public key is public, so anyone holding it can encrypt something to you, and there is no signature in the envelope to say who did. It protects the contents from everybody except the holder of the private key. It does not tell that holder who they are hearing from.

If you are choosing between this and a proper messenger, use the messenger. Signal and its equivalents verify keys, rotate them, and protect past messages if a device is later seized, and this does none of those things. CIPHER is for the case where you are stuck with a channel you do not trust (a corporate mail system, a support ticket, a forum message, a USB stick) and need the contents to be unreadable while they sit in it. For a file rather than a message, CAPSULE makes an encrypted file anyone can open in a browser, KEYRING does it with age keys, and SHADOWKEY makes a passphrase worth using.