What Is VERNAM and What Does It Do?

VERNAM (vernam.app) is a free, open-source file encryption tool that runs entirely in your browser. You drop in a file, set a passphrase, and get an encrypted copy back — the file and passphrase never touch a server. It is built by PrivacyTools.io and uses XChaCha20-Poly1305 for encryption and Argon2id for key derivation. It suits anyone who needs to send or store a sensitive file without creating an account or trusting a cloud service; it is not a password manager, a secure messenger, or a backup service.

What VERNAM actually does

The tool has one job: turn a file into an encrypted .vrn file, and turn a .vrn file back into the original. The page describes a single drop zone that auto-detects whether you are encrypting or decrypting, so there is no mode switch to get wrong.

• Encrypt: drop a file, set or generate a passphrase, and download the sealed result.
• Decrypt: open a .vrn file someone sent you and enter the exact passphrase used to create it.
• No account, no upload: everything happens inside the browser tab. The page states plainly that files and passwords never touch a server, and that it works offline.

Because there is no server-side component, there is also no "forgot password" path. The passphrase is the only key and is never stored, so a wrong passphrase simply fails.

How the encryption works

The page lays out a four-step process, and understanding it explains both the security and the limits.

1. You set a passphrase. You can type your own or use the built-in generator.
2. The passphrase becomes a key. Argon2id stretches it into a 256-bit key. Argon2id is deliberately slow and memory-hungry, which makes guessing passphrases expensive.
3. The file is sealed. XChaCha20-Poly1305 encrypts the file in chunks and authenticates each chunk, so tampering is detected.
4. Only the passphrase opens it. The output is designed to be indistinguishable from random data.

The page notes these are the same algorithms used by Signal, WireGuard, and 1Password. That is a reasonable signal of maturity, but it describes the primitives, not an independent audit of this specific tool — the open-source code is the thing to review if you want to verify the implementation yourself.

The passphrase generator

Tapping the dice generates six random words from the 2048-word BIP39 list — the same wordlist behind crypto wallet seed phrases. The page puts this at roughly 66 bits of entropy, which it describes as strong against brute-force attack while remaining easy to write down. That trade-off is the point: a six-word phrase is far stronger than a short password and far easier to record accurately than a random character string.

High security mode

There is an optional toggle that makes key derivation heavier: 256 MiB of memory and 3 passes with Argon2id, versus the standard setting. The page frames it as making each brute-force guess far costlier and explicitly says it is not recommended for low-RAM devices. Use it when the file is highly sensitive and the machine can spare the memory; skip it on phones or older laptops where the tab may stall.

What it does not do

Setting expectations correctly matters more than the feature list here:

The self-hosting condition is worth noting: the license terms as described require that attribution link, so "open source" here does not mean attribution-free redistribution.

When to use it, and when not to

Good fit: sending a contract, ID scan, or export to someone over email or chat, where you can share the passphrase through a separate channel; encrypting a file before putting it on a USB stick or a cloud drive; opening a .vrn file a colleague sent you.

Poor fit: anything you might need to recover without the passphrase; large files on a low-memory device with high security mode on; situations where you need a shared vault or team access control — this is a one-file-in, one-file-out tool.

One practical habit: deliver the passphrase through a different channel than the file. The encryption is only as good as the separation between the two.

Is it trustworthy?

The honest answer is "check the code, not the marketing." The page's own framing supports this: it invites you to read the source, notes there is no server to hack and no account to breach, and states the tool requires JavaScript to encrypt locally. The cryptography choices are mainstream and well-regarded. The remaining question — whether this implementation uses them correctly — is answerable only by reading the repository, which the project makes available. For a casual user protecting a file in transit, that is a reasonable bar; for high-stakes material, have someone review the code or test it against a known-good implementation first.