seal
Text sealed with a passphrase, opened with the same one. The text and the passphrase stay in this browser.
This browser doesn't offer WebCrypto on this page, so nothing can be sealed or opened here.
AES-256-GCM, with the key derived from the passphrase by PBKDF2-HMAC-SHA-256 over 600,000 iterations and a random salt. Argon2 would stand up to guessing better, but browsers don't offer it, and a copy written in JavaScript would have nothing in the browser to check it against.
Anyone holding an envelope can try passphrases against it offline, for as long as they like, and the iterations only make each try slower. So the passphrase has to be long. Generate makes sixteen characters in four groups from an alphabet without i, l, o or u, which comes to 80 bits; the envelope opens only when they are typed exactly as shown, dashes included.
A link carries the envelope after the #, which browsers don't send when they ask for the page. ?from= loads one from a path on this site instead. Either way the page waits for a passphrase, and before doing any work it refuses an envelope that asks for more than ten million iterations.