SecureMint
Security by Design

Security

How SecureMint protects your data — a technical overview.

End-to-End Encryption

AES-256-GCM

All file encryption uses AES-256-GCM (Authenticated Encryption). Encryption and decryption happen entirely in your browser using the Web Crypto API. Plaintext never reaches our servers.

// Encryption parameters

Algorithm: AES-256-GCM

Key derivation: PBKDF2-SHA256 (600,000 iterations)

IV: 12 bytes (crypto.getRandomValues)

Salt: 16 bytes (crypto.getRandomValues)

Key Derivation

PBKDF2

Password-based key derivation uses PBKDF2-SHA256 with 600,000 iterations (OWASP 2024 recommendation). This provides strong resistance against brute-force attacks.

How Secure File Sharing Works

E2E
1Generate random AES-256 key in browser
2Encrypt file with AES-256-GCM
3Upload only ciphertext to server (Cloudflare R2)
4Generate share link with decryption key in URL fragment (#)
5Recipient opens link — browser extracts key and decrypts

The URL fragment (#) is never sent in HTTP requests — it doesn't appear in server logs. By design, no one (including the server operator) can access the decryption key.

Browser-Only Guarantee

Zero Server

File encryption (.enc) and password generation run entirely in your browser. Zero network communication occurs. You can verify this using your browser's Developer Tools (Network tab).

.enc File Format

Open

[magic: 8 bytes "SMINT01\0"]

[version: 1 byte]

[salt: 16 bytes]

[iv: 12 bytes]

[filename_length: 2 bytes (uint16 BE)]

[encrypted_payload: filename + file data]

[auth_tag: 16 bytes (GCM)]

Transparency

Open

The core encryption logic is open source. Security researchers and users can verify the implementation.

Post-Quantum Cryptography Roadmap

Roadmap

Advances in quantum computing may eventually compromise public-key algorithms like RSA and ECDH. SecureMint's core design relies on symmetric encryption (AES-256-GCM), which remains resistant to known quantum attacks. For SecureChannel's public-key components, we are planning the following transition.

1[Current] AES-256-GCM (symmetric) is quantum-resistant. Even Grover's algorithm yields an effective 128-bit security level.
2[2026-2027] Evaluate and prototype ML-KEM (formerly CRYSTALS-Kyber), standardized by NIST.
3[2027-2028] Migrate SecureChannel key exchange to hybrid mode (X25519 + ML-KEM-768).
4[Future] Transition to browser-native implementation once Web Crypto API supports post-quantum algorithms.

SecureMint's file encryption (AES-256-GCM) and password-based key derivation (PBKDF2) maintain sufficient security against quantum computers.