Blackhole Encryption FAQ & Best Practices

• Argon2id Key Derivation: Memory-hard algorithm resistant to GPU attacks
• AES-GCM Encryption: 256-bit encryption with authenticated encryption mode
• Random Salt Generation: Each file gets a unique 32-byte salt
• Dual Key System: Uses both Key Encryption Key (KEK) and Data Encryption Key (DEK)
• Tag Chaining: Each chunk's authentication tag depends on the previous chunk

Encryption Process

1. Your password is used with Argon2id to derive a Key Encryption Key (KEK)
2. A random Data Encryption Key (DEK) is generated and encrypted with the KEK
3. The file is encrypted in chunks using AES-GCM with the DEK
4. The result is saved as a .enc file

• Remember your password: There is no password recovery. If you lose your password, your files cannot be decrypted.
• Strong passwords recommended: Use at least 12 characters with a mix of uppercase, lowercase, numbers, and symbols.
• File format: Files are encrypted using standard .enc format with AES-256-GCM encryption.
• Your files stay with you: Nothing you encrypt or decrypt is sent anywhere. It is read by the page, worked on in your browser, and handed straight back to you.
• Security: Your password never leaves your device. All encryption happens client-side in your browser using industry-standard cryptography.
• Performance: Large files may take longer to encrypt/decrypt due to the strength of the Argon2id algorithm.

Everything here is free, unlimited, and needs no account. There is nothing to sign up for and nothing to buy. All three settings below are yours to choose.

• Memory cost: 256 MB to 2 GB. How much RAM each password guess costs an attacker, and the setting that matters most against someone with graphics cards or custom hardware — 2 GB per guess is punishing in a way 256 MB is not. It is also RAM your own browser has to find, so very large values may struggle on a phone.
• Time cost: 1 to 20 passes over that memory. Doubling it doubles the cost of every guess, and doubles your own wait.
• Parallelism: fixed at one lane and not adjustable. Argon2 in a browser runs on a single thread, so extra lanes would not speed you up, and they would split the memory into smaller pieces that an attacker with parallel hardware can work through at once.

The settings you choose are written into the encrypted file, so decrypting needs nothing but your password — the sliders on the Decrypt page do not have to match.

What file formats can I encrypt?

Any file format can be encrypted - documents, images, videos, archives, etc. The encrypted file will have a .enc extension.

How large can my files be?

There is no limit we impose. The practical ceiling is your own browser: the file is held in memory while it is worked on, so a very large file on a machine with little RAM may fail where a smaller one succeeds.

Do I need an account?

No. There is nothing to register for, nothing to pay for, and no limit on how much you encrypt or decrypt. Everything on this site works the same whether you have ever been here before or not.

Can I decrypt files on different devices?

Yes! As long as you have the correct password, you can decrypt your files on any device using the web interface.

What happens to my files when I use this?

They are never sent to us. Choosing a file lets the page read it into your browser's memory; the encrypted or decrypted result is built there and saved straight from your browser to your disk. Nothing is uploaded, so there is nothing of yours on our servers to delete, keep, or lose.

Closing or reloading the tab discards whatever was in memory, so download your result before you leave the page.

Is my password stored anywhere?

No. Your password is only used in your browser to perform the encryption/decryption. It never leaves your device and is never sent to the server.

Does this hide my file names?

No. An encrypted file keeps its original name with .enc on the end, so the name is still readable to anyone who can see the file — the contents are protected, the name is not. Rename the file yourself if the name matters.

The Blackhole desktop application does hide names: it encrypts the real one inside the file and can restore it later. That is not something a web page can do as well, so it lives there.

What if I don't want my files on your server?

They never go there. All encryption and decryption happens in your browser, and no part of your file — encrypted or otherwise — is sent to us at any point. Neither is your password. The only things our server ever sees are the ordinary requests for the pages themselves.

You do not have to take our word for it: open your browser's developer tools, watch the Network tab, and encrypt a file. You will see no request carrying it.

Blackhole is provided as-is, with no warranty of any kind, and you use it entirely at your own risk.

There is no way to recover your password

Your password never reaches us, which is the point — and it means we cannot reset it, recover it, or help you get back into a file. If you forget the password to an encrypted file, that file is gone. Permanently. Nobody can help you, including us. Keep your own copy of any password that matters to you, somewhere you trust, before you rely on this service for anything.

Keep your own backups

Never let an encrypted file be the only copy of something you cannot afford to lose. Encryption can fail for reasons that have nothing to do with us: a corrupted download, a full disk, a browser that closed mid-operation, a bug we have not found yet. Keep the original somewhere safe until you have confirmed the encrypted copy decrypts correctly.

No guarantee of availability or continuity

This service may be slow, unavailable, changed, or discontinued at any time and without notice. We store nothing of yours, so there is nothing here for you to come back for — do not depend on this service being here tomorrow, and do not use it as storage.

No guarantee of security or fitness for any purpose

We have built this carefully and we describe honestly how it works, but we make no representation that it is free of defects, that it is suitable for protecting any particular information, or that it meets any legal, regulatory, professional, or contractual standard you may be subject to. If you are handling material where a failure would cause real harm — legal, medical, financial, or personal safety — you need a solution with guarantees behind it, and this is not that. Some settings on this site are limits on what the interface offers, not security boundaries we can enforce.

No liability, and no personal responsibility accepted

To the fullest extent permitted by law, neither the operator of this service nor anyone associated with it accepts any liability whatsoever for any loss or damage arising from your use of it. That includes lost, corrupted, or inaccessible files, lost or forgotten passwords, disclosure of information, business or financial loss, and any indirect or consequential loss of any kind — whether or not such loss was foreseeable, and whether the claim arises in contract, negligence, or otherwise. No individual associated with this service accepts personal responsibility for any outcome of your use of it.

Using it is your decision

By using Blackhole you accept all of the above, and you accept that the decision to trust it with any particular file is entirely yours to make and yours to live with. If you are not comfortable with that, please do not use it.