What Does VERNAM’s High Security Mode Change?

VERNAM’s high security mode makes key derivation heavier: it uses Argon2id with 256 MiB of memory and 3 passes instead of the standard setting. That raises the cost of each brute-force guess against your passphrase. The site says standard protection is “plenty for most files” and does not recommend high security mode for low-RAM devices. Turn it on when the file is especially sensitive and the device has enough memory; otherwise, the standard mode is the intended default.

What actually changes

The mode affects how your passphrase is stretched into the 256-bit encryption key. It does not change the file encryption algorithm itself: VERNAM uses XChaCha20-Poly1305 to encrypt the file in chunks and sign each one, so tampering is detected.

The page does not publish the standard mode’s exact memory and pass counts, so do not assume they match the high security figures.

Why heavier key derivation matters

A passphrase is the only key. VERNAM never stores it, and a wrong passphrase simply fails with no recovery. If someone obtains an encrypted file, their practical route is to guess passphrases and test each guess. Argon2id is designed to make that testing expensive by consuming memory and repeated work per guess.

High security mode raises that per-guess cost. It does not rescue a weak passphrase, though. The page recommends generating a strong one: its generator draws six random words from the 2048-word BIP39 list, about 66 bits of entropy. A strong passphrase plus high security mode is a layered choice; high security mode alone is not a substitute for a weak passphrase.

When to turn it on

Use high security mode when:

• The file is especially sensitive and you want each password guess to cost more.
• You are encrypting on a device with enough RAM to handle 256 MiB of key derivation memory plus the browser’s own use.
• You can tolerate a longer wait. The page warns that encryption “can take a moment, especially key derivation.”

Keep the standard mode when:

• You are encrypting ordinary files, where the page says standard protection is plenty.
• You are on a low-RAM phone, tablet, or older computer. The page explicitly does not recommend high security mode there.
• You need the quickest result and your passphrase is already strong.

How to use it and what to expect

1. Open VERNAM in a browser with JavaScript enabled. The page states the tool needs JavaScript to encrypt files locally.
2. Drop a file or browse to select it. The page auto-detects whether you are encrypting or decrypting.
3. Set a passphrase, or tap the dice to generate one. Record it exactly; it is never stored and cannot be recovered.
4. Turn on high security mode if the conditions above apply.
5. Start encryption and wait for key derivation. A “Working” state may appear, especially in high security mode.
6. Confirm the “Encrypted” result, then save or send the file.

Everything happens inside the browser. The page says files and passwords never touch a server, no account is needed, and the tool works offline. The output is designed to be indistinguishable from random noise.

Common snags

• Slow or stalled on a low-memory device: high security mode’s 256 MiB requirement can strain low-RAM hardware. Switch back to standard mode.
• Forgotten or mistyped passphrase: there is no recovery. A wrong passphrase just fails. Keep the exact passphrase, including spacing and capitalization, if you generated one.
• JavaScript disabled: the local encryption tool will not run. The page notes this requirement.
• Expecting the mode to fix a weak passphrase: it raises guessing cost but does not add entropy. Use the generator or another strong passphrase.

VERNAM is free, open source, and client-side, according to the page. The high security mode is a deliberate trade: more resistance to brute-force guessing in exchange for more memory use and a longer key-derivation wait.