Seal for
Accepted: an AS1 key string, a PEM or DER public key from OpenSSL or another FIPS 203 tool, the bare 1184-byte ML-KEM-768 key as base64 or hex, or a almin™ Seal key file.
Drop sealed .pqf files below. They are unsealed with the private key open on the left; the original file name is restored.
How this works, and what it does not promise
Key agreement. For every file a fresh secret is agreed using two independent methods: ML-KEM (the NIST FIPS 203 lattice-based standard, implemented here from the specification; ML-KEM-768 is Security Category 3, ML-KEM-1024 is Category 5, chosen when the key is created) and X25519 elliptic-curve Diffie-Hellman. ML-KEM is mixed into the file key unconditionally, with no mode that derives it from X25519 alone; an unseal that is missing the ML-KEM half, or whose ML-KEM half is rejected, fails. The two shared secrets are combined through HKDF-SHA-256 with an info string that names the product, the container version, the exact ML-KEM parameter set, and whether X25519 is mixed in: AlminSeal/PQF1/KDFv2/<ML-KEM-768|ML-KEM-1024>/<hybrid+X25519|kem-only>/<layer>, published in full in the About panel and asserted in the test log. An attacker must break both secrets, so a flaw in either one on its own is not enough.
Content. HKDF derives a 256-bit AES-256-GCM key from the key agreement. The file is processed in 4 MiB blocks, each sealed with AES-256-GCM with its own authentication tag bound to the header, the block's position, and whether it is last, so truncation, reordering, substitution and bit-flips are all rejected. Files are read and written in a stream, so size is limited by your disk, not by memory. This edition can also open files sealed by almin™ Seal | Pro with its optional second cipher layer.
Harvest now, decrypt later. Data captured today and stored until a quantum computer exists is the threat this design addresses: the lattice half of the key agreement is not known to be breakable by Shor's algorithm. Nothing in this page is a "new quantum algorithm"; new cryptography that has not survived years of public analysis is precisely what you should not trust, so this page uses the standardised primitives instead.
Limits, honestly stated. This implementation has been tested against an independent ML-KEM reference and checked against tampering, but it has not had a professional security audit. JavaScript cannot guarantee constant-time execution, so a hostile process sharing your machine is out of scope. Passphrase protection (Argon2id or PBKDF2-SHA-256) raises the cost of each guess against a stolen key file; it does not make guessing impossible. It is only as strong as the passphrase itself, so four or more random words, or a similar amount of genuine randomness, is what actually does the protecting. Sealed files hide their contents and original name but not their approximate size. With an ML-KEM-1024 key the lattice half reaches Category 5, but the X25519 half remains a 128-bit classical component; the post-quantum margin rises, the classical fallback does not.
Other FIPS 203 tools. FIPS 203 defines only the key encapsulation step, not a file format, so a file sealed by another application cannot be opened here unless that application's container is implemented too. What does work across tools is the key itself: this page accepts ML-KEM-768 and ML-KEM-1024 public keys in PEM, DER, base64 or hex from OpenSSL and similar, and sealing for such a key uses ML-KEM only (no X25519 half).
Format. .pqf container, version 1: magic, flags (hybrid, ML-KEM-1024, double seal for files from Pro, and the key-derivation info string below), 8-byte recipient key id, ML-KEM ciphertext (1088 bytes for ML-KEM-768, 1568 for ML-KEM-1024, chosen by a flag), X25519 ephemeral key (zero when the profile is ASD / PQC only), HKDF salt, block size, length, encrypted metadata, then the authenticated blocks (16 bytes of tag per block). A reader rejects any flag bit it does not recognise rather than guessing. The HKDF info string for new seals is AlminSeal/PQF1/KDFv2/<ML-KEM-768|ML-KEM-1024>/<hybrid+X25519|kem-only>/outer-AES-256-GCM.