How VERNAM Encrypts a File in Your Browser

VERNAM encrypts a file entirely inside your browser: you drop a file, set or generate a passphrase, and the page derives a 256-bit key with Argon2id, then seals the file in chunks with XChaCha20-Poly1305 and writes the result as a .vrn file. Nothing is uploaded, no account is needed, and the passphrase is never stored—so a lost passphrase means the file cannot be recovered by anyone, including you. This applies to any file type and works offline once the page is loaded.

The encryption flow, step by step

1. Choose a passphrase

You can type your own or tap the dice to generate one. The generator draws six random words from the 2048-word BIP39 wordlist—the same list used for crypto wallet seed phrases—giving roughly 66 bits of entropy. That is strong against brute-force guessing while staying easy to write down.

The page shows a passphrase strength indicator as you type. Whatever you choose becomes the only key to the file.

2. Passphrase becomes a key

Your passphrase is stretched into a 256-bit key using Argon2id, an algorithm designed to make password cracking expensive. VERNAM offers a High security mode that uses heavier key derivation: 256 MiB of memory and 3 passes. The page notes this is not recommended for low-RAM devices, since it makes each guess far costlier for an attacker but also takes longer and uses more memory on your machine.

3. File is sealed in chunks

XChaCha20-Poly1305 encrypts the file in chunks and signs each chunk, so any tampering is detected immediately. The output is indistinguishable from random noise. The page states these are the same cryptography families used to protect Signal, WireGuard, and 1Password.

4. Output and decryption

The result is a .vrn file. To open one—yours or one someone sent you—drop it into the same page. VERNAM auto-detects whether to encrypt or decrypt, so you do not pick a mode manually. You then enter the exact passphrase the file was encrypted with.

What to expect while it runs

• A waiting moment is normal. The page warns that encryption "can take a moment, especially key derivation"—Argon2id is intentionally slow.
• JavaScript is required. The tool needs JavaScript to encrypt locally in your browser; nothing is uploaded either way.
• No recovery path. The passphrase is the only key and is never stored anywhere. A wrong passphrase simply fails.

Practical checks before you rely on it

Because the project is open source, you can read the code rather than trust a description. For a file you will need months from now, write the generated six-word passphrase down and store it separately from the .vrn file—those two items together are the whole security model.