AES-256-GCM

Passphrase + PBKDF2 key derivation, local encrypt/decrypt。 Runs locally—nothing uploaded.