Last Updated: January 2026

Applies to: Desktop Application and Web Application

Please read these terms carefully before using Synexmedia Secure Encryptor. By clicking "I Agree", you signify your agreement to these terms.

1. Purpose of This Software

Synexmedia Secure Encryptor is designed to provide general-purpose cryptographic tools for file protection, encryption, and secure data handling. While the software implements industry-recognized cryptographic techniques, no security system is infallible.

This software is provided for informational, educational, and general security use only.

2. No Guarantee of Absolute Security

No encryption software can guarantee absolute protection against:

Unauthorized access
Data loss
Key compromise
Malware or system-level attacks
Hardware failures
Human error

Security depends on proper usage, system integrity, key management, and user practices.

3. User Responsibility

By using Synexmedia Secure Encryptor, you acknowledge that:

You are solely responsible for:

Safeguarding passwords, keys, and recovery data
Verifying encrypted output
Maintaining secure operating environments

⚠️ Loss of encryption keys or passwords may result in permanent data loss

Encrypted data cannot be recovered by Synexmedia if credentials are lost

4. Prohibited / High-Risk Uses

This software is NOT intended for use in:

Life-critical systems
Medical devices or patient care systems
Nuclear facilities
Military weapons systems
Aviation control systems
Emergency response infrastructure

Use in such contexts is entirely at your own risk.

5. No Professional Advice

Synexmedia Secure Encryptor does not constitute legal, cybersecurity, compliance, or regulatory advice. Users should consult qualified professionals when security, legal, or regulatory obligations apply.

6. Limitation of Liability

To the fullest extent permitted by law, Synexmedia, its developers, and contributors shall not be liable for:

Data loss
Security breaches
Business interruption
Financial loss
Incidental or consequential damages

This applies whether the software is used correctly or incorrectly.

7. Relationship to MIT License

This disclaimer supplements but does not replace the MIT License governing the source code. The MIT License terms remain fully in effect.

📜 About Synexmedia Secure Encryptor

Synexmedia Secure Encryptor is a privacy-focused encryption application developed by Synexmedia, designed to give individuals and organizations greater control over their data through modern cryptographic techniques.

The application is available as both a desktop application and a web-based tool, with select components released under open-source licensing.

⚖️ Licensing

Portions of Synexmedia Secure Encryptor are released under the MIT License, a permissive open-source license that allows use, modification, and distribution with minimal restrictions.

Other components, services, branding, and infrastructure may remain proprietary and are not automatically covered by the open-source license.

🔒 Security Notice

Encryption is a powerful tool, but security is a shared responsibility. Users are responsible for proper key management, secure device usage, and safe password practices.

📞 Contact

For licensing inquiries, security disclosures, or legal questions:

Synexmedia
🌐 https://synexmedia.com

⚖️ Jurisdiction

This software and its legal terms are governed by the laws of Canada, without regard to conflict-of-law principles.

By clicking "I Agree", you acknowledge that you have read, understood, and agree to be bound by these Terms, and you explicitly accept all risks including permanent data loss.

I have read and agree to the Terms of Use

Encryption Algorithm

AES-256-GCM: NIST-approved, hardware-accelerated AEAD encryption
ChaCha20-Poly1305: Google-designed, constant-time, resistant to timing attacks

Key Derivation Function

⭐ RECOMMENDED: PBKDF2-SHA256 (5M iterations) provides excellent security with universal compatibility.
Argon2id Options: More secure but may fail on devices with limited memory. Test before using.
For Files: You can use Argon2id for individual file encryption even if vault uses PBKDF2.

Show Technical Details

Display encryption parameters in output

ℹ️ About & Certificate Information

Application: Synex Secure Encryptor
Version: 2.0.0
Developer: Synexmedia.com

📜 Code Signing Certificate:

                                macOS: ✅ Digitally Signed

                                Certificate ID: 3A902279BCF53402B1AA1E96977B99885CAEA3CA

                                Publisher: Synexmedia.com

                                Type: Apple Developer Certificate

                                Windows: ⚠️ Not Signed

                                Windows code signing requires a CA-issued certificate ($100-500/year)

How to verify: See the verification guide in the Instructions section (📖 button) for detailed steps on how to check the certificate on your device.

by Synexmedia.com at synexmedia.com

🔐 Security Architecture

This application uses dual-algorithm AEAD encryption (AES-256-GCM or ChaCha20-Poly1305) with PBKDF2-SHA256 key derivation (5 million iterations) - industry-proven and configured for maximum compatibility with excellent security.

100% Client-Side Encryption: All encryption, decryption, and key derivation happens in your browser. Passwords, keys, and file contents never leave your device. (The web build inherits site-wide analytics that report only page path / referrer / screen size — never encryption state. The desktop build runs fully offline.)
Zero-Knowledge: No server ever sees your data, passwords, or keys — there is no server in the encryption pipeline.
Dual Algorithm Support: Choose between AES-256-GCM (hardware-accelerated) or ChaCha20-Poly1305 (constant-time, Google-designed).
Authenticated Encryption: Both algorithms provide confidentiality and integrity (AEAD).
OWASP-Compliant KDF: 5M iterations exceeds OWASP recommendations (600k minimum), providing strong protection.
Universal Compatibility: Works on all devices including mobile, without memory allocation issues.
Secure Randomness: Uses Web Crypto API for cryptographically secure random number generation.
Vault Auth Model: Your master password is verified by attempting to decrypt your vault — there is no separate password hash stored in localStorage. AES-GCM auth-tag failure is the password check, so an attacker with localStorage access cannot brute-force a bare hash; they must pay the full PBKDF2 + AES-GCM cost per guess against the vault blob itself.
Session Key Caching: After login, only a non-extractable WebCrypto CryptoKey lives in memory — your plaintext password is unreachable for the rest of the session. An attacker who somehow obtains the cached key can use it to encrypt/decrypt your vault, but cannot extract it to compromise the same password on other services where you may have reused it.
File Format Integrity: Encrypted files use a versioned magic header (SYNEX\x02) for deterministic format detection, plus an integrity check that verifies the unauthenticated KDF byte in the header against the authenticated KDF identifier inside the encrypted payload. Tampering with the outer KDF byte is detected and rejected with a clear error rather than a confusing "wrong password" message.
Vault Format Auto-Upgrade: Vaults written by older versions are automatically upgraded to the current format on first login (deterministic single-KDF parsing, canonical PBKDF2-5M, no legacy verifier fields). One-time, transparent, no user action needed.

⚠️ Your Responsibility

Security is YOUR responsibility. If you forget your password or lose your key file, your data will be permanently unrecoverable. There is no backdoor, no recovery mechanism, no "forgot password" feature. This is by design for maximum security.

🛡️ Security Model & Limitations

⚠️ Core Security Assumption:
Designed for offline use on a clean machine with no malicious extensions. If your OS or browser is compromised, Synex Secure Encryptor cannot protect you.

Threat Model - What This App Protects:

✅ Data at rest: Encrypted files stored on untrusted cloud services, USB drives, or shared storage
✅ Data in transit: Encrypted messages sent over insecure channels (email, messaging apps)
✅ Offline password attacks: Strong KDF (PBKDF2-SHA256, 5M iterations by default; Argon2id available as a memory-hard alternative) raises the per-guess cost against brute-force attacks on stolen encrypted files. Effectiveness scales with password strength.
✅ Unauthorized access: Without password AND key file (if used), data remains encrypted
✅ Header tampering: Modifying the unauthenticated KDF byte or algorithm byte in the file header (e.g. an attacker downgrading pbkdf2-5m → pbkdf2-2m) is detected by an integrity check that compares the outer header against the authenticated metadata inside the encrypted payload. Tampered files are rejected with a clear error.

What This App Does NOT Protect Against:

❌ Compromised device: Keyloggers, screen capture malware, rootkits, or malicious browser extensions
❌ Memory forensics: Sensitive data in RAM (mitigated by memory wiping, but not foolproof)
❌ Supply-chain attacks: Malicious modifications to this file or browser (verify hash, run offline)
❌ Physical access attacks: $5 wrench attacks, coercion, or legal compulsion to reveal passwords

⚠️ Critical Security Warnings:

Trusted Device Required: Only use on a device you trust and control
✅ Local-Only Encryption: The encryption pipeline runs entirely in your browser — passwords, keys, and file contents never leave your device. All cryptographic libraries (Argon2id + ChaCha20-Poly1305) are bundled locally. Note: when accessed via the web, the page inherits site-wide analytics (page path, referrer, screen size only — not encryption state). The desktop build runs fully offline.
Local Storage Only: All vault data and user accounts are stored in browser localStorage. Use OS-level full-disk encryption for defense in depth.
Keyfile Warning: If you lose both your password AND your key file, your data is PERMANENTLY UNRECOVERABLE. There is no password reset or recovery mechanism.
Maximum Security: Download this HTML file, verify its hash, disconnect from the internet, and run locally from file:// for complete isolation.

🔐 How to Encrypt

Choose Text or File mode
Enter your message or select your file
Create a strong password (use the generator for best results)
Recommended: Add a Key File for maximum security (any file works)
Click Encrypt
Copy the encrypted output or download the .aegis file
IMPORTANT: Securely store your password and key file!

🔓 How to Decrypt

Choose Text or File mode
Paste encrypted text or select the .aegis file
Enter the exact same password
If you used a Key File, provide the exact same file
Click Decrypt
Your original data will be restored

📱 How to Use QR Codes

QR codes allow you to transfer encrypted messages between devices by scanning with your phone camera.

Generate & Share QR Code:

Encrypt your message in Text mode
Click 📱 Show QR Code button (appears after encryption)
Choose how to share:
- 💾 Download QR - Save as PNG image to your device
- 📋 Copy QR - Copy image to clipboard, paste into messages/emails
- Scan directly - Show QR code on screen, scan with recipient's phone

Scan & Decrypt QR Code:

Go to Decrypt section
Stay in Text mode
Click 📷 Scan QR Code button
Select the QR code image from your device
Encrypted data will automatically appear in the decrypt field
Enter your password and click Decrypt

⚠️ QR Code Limitation: Maximum 2000 characters of encrypted data. For longer messages or files, use regular text/file encryption instead.

💡 Pro Tips

Use the password generator for maximum security (aim for 256+ bits entropy)
Enable a Key File for two-factor security
Backup your password safely - use a password manager
QR Codes: Perfect for sharing short encrypted messages between devices - see QR Code section above
Keyboard Shortcuts: Ctrl+E (Encrypt), Ctrl+D (Decrypt), Ctrl+G (Generate Password)

🆚 How This Compares

This application exceeds industry standards:

PBKDF2-SHA256 (5M iterations) - 8.3x stronger than OWASP minimum (600k), industry-proven security
Universal Compatibility: Works reliably on all devices without memory constraints
Dual Algorithm Choice: AES-256-GCM (hardware-accelerated) or ChaCha20-Poly1305 (constant-time, timing-attack resistant)
Enterprise-Grade AEAD: Both algorithms used by Signal, Google, WireGuard, and government agencies
Optional Key File - two-factor encryption not found in most online tools
True zero-knowledge - your data never touches a server
Argon2id Available: Can still use memory-hard KDF for individual file encryption

🔍 Certificate Verification Guide

Verify the authenticity of this application by checking the developer certificate:

✅ macOS Verification (Signed)

Method 1: Using Finder (GUI)

Right-click on Synex Secure Encryptor.app
Select "Get Info"
Look for code signature information in the "General" section
Verify the developer certificate shows "Synexmedia.com"

Method 2: Using Terminal

                                codesign -dvv "/Applications/Synex Secure Encryptor.app"
                            

This displays detailed signing information including the certificate ID: 3A902279BCF53402B1AA1E96977B99885CAEA3CA

Method 3: Verify Signature Validity

                                spctl -a -vv "/Applications/Synex Secure Encryptor.app"
                            

If valid, you'll see: "accepted" with source information

⚠️ Windows Verification (Not Signed)

The Windows executable is currently not digitally signed. Windows code signing requires a CA-issued certificate ($100-500/year).

If we sign in the future, you can verify by:

Right-click the .exe file
Select "Properties"
Go to the "Digital Signatures" tab
Select the signature and click "Details"
Verify the publisher is "Synexmedia.com"

💡 Pro Tip: For complete verification information including certificate details, check the About & Certificate Information section in Settings (⚙️ button).

Secure Encryptor

Encrypted Password Manager

Add New Entry