© 2026 José Carrillo
How it works
Understanding every step of the encryption process
Overview
Zefer is a 100% client-side tool. All cryptographic processing happens in your browser. There is no server that stores, processes, or transmits your data. You can encrypt plain text or any file type (images, ZIPs, PDFs, etc.) into a password-protected .zefer file, with advanced security options like dual passphrase, reveal key, secret question, IP restriction, expiration, and compression.
Step 1: Content input
You select Text or File mode. In text mode, you type or paste your secret directly. In file mode, you upload any file type (images, ZIPs, PDFs, etc.) with a dynamic limit based on your device's capacity. You also define a passphrase and an expiration date. Everything remains exclusively in your browser's memory.
Step 2: Key derivation with PBKDF2
Your passphrase is transformed into a 256-bit cryptographic key using PBKDF2-SHA256 with 600,000 iterations and a unique random 32-byte salt. This process ensures even simple passphrases produce extremely strong keys.
Step 3: AES-256-GCM encryption
Your content, along with the expiration date and metadata, is encrypted as a single piece using AES-256-GCM with a random 12-byte initialization vector (IV). The expiration lives inside the ciphertext, so it cannot be tampered with without the correct key.
Step 4: .zefer file generation
The ciphertext is packaged into a .zefer file that is downloaded directly to your device. No data leaves your browser. There is no server involved at any point in the process.
Step 5: Sending the file
You send the .zefer file to your recipient through any channel: email, chat, or SMS. The passphrase should be communicated through a separate channel for maximum security. Without the passphrase, the file is completely unreadable.
Step 6: Decryption by the recipient
The recipient uploads the .zefer file to Zefer and enters the passphrase. Their browser repeats the key derivation process, decrypts the content, and checks the expiration. If the passphrase is incorrect, decryption fails revealing no information. If the file has expired, access is denied.
Step 7: View or download
Once decrypted, the recipient can view the content directly in the browser, copy it to the clipboard, or download it as a text file. At no point does the data pass through a server.
Advanced security options
Configurable security level
Choose between 300k, 600k, or 1 million PBKDF2 iterations. More iterations = slower to decrypt = more secure against brute force.
Reveal key and dual passphrase
Generate a reveal key to share without exposing your main password. You can also require two passphrases from different people to decrypt.
IP restriction
Restrict decryption to specific IP addresses (IPv4 and IPv6). The IP list is encrypted inside the file and is not visible without the key.
Device detection
Zefer analyzes your device's RAM, CPU, GPU, and platform to dynamically calculate the maximum file limit at 80% of available capacity.
Secure key generator
Generate random keys from 64 to 1,024 characters with Unicode support (Latin, Arabic, Japanese, Chinese, Korean, Greek, Cyrillic, emojis), alphanumeric, hexadecimal, or UUID v7.
Technical specifications
How passwords are generated
The generator (in the encrypt form and at /generator) produces keys with real cryptographic guarantees, 100% on your device:
Cryptographic randomness (CSPRNG)
Every character comes from crypto.getRandomValues, the operating system's secure generator — never from Math.random().
Rejection sampling
Random values that would introduce modulo bias are discarded, guaranteeing a perfectly uniform distribution over the alphabet.
7 alphabets
Unicode (~668 symbols: CJK, Cyrillic, emoji…), Secure (Latin + symbols + accents), Alphanumeric, Hex, Readable (Base58, no 0 O I l), PIN and UUID v7 (RFC 9562).
Analysis and scoring
Every key is evaluated: maximum and effective entropy (with pattern penalties), crack time across 4 attack scenarios (10²–10¹⁵ guesses/s) and compliance against NIST SP 800-63B, OWASP, AES-128 and post-quantum resistance (Grover).
Advanced options
Exclusion of ambiguous or custom characters, all-classes guarantee, no consecutive repeats and dash grouping — without affecting sampling uniformity.
Available to AI agents (MCP)
The whole engine — encryption, generation, analysis and inspection — is also exposed as a Model Context Protocol server via zefer-cli, for Claude, Cursor, Windsurf or any compatible tool.
Use Zefer your way
The same encryption engine and the same .zefer format across every channel — files are 100% compatible between them.
Web app
Encrypt and decrypt in your browser — nothing to install.
Command line
zefer-cli for scripts, automation and CI. npm or a standalone binary.
MCP server
Let AI agents encrypt, decrypt and analyze via the Model Context Protocol.
Node.js library
Import the same engine into your code (ESM and CommonJS) since v1.3.0.