File Encryptor — Java source

// File Encryptor — password-based AES-256-GCM file encryption.
//
// Language: Java (17+, standard library only)
// Ported from src/lib/file-encryptor.ts
// display source — part of CosmoDev's polyglot tool pages.
//
// Wire format:  salt (16 B) || IV (12 B) || AES-256-GCM ciphertext + tag.
// The 256-bit key is derived from the password with PBKDF2-SHA256 and a fresh
// random salt per encryption, so the same file + password never encrypts to
// the same bytes, and the password itself is never stored or derivable from
// the output. 100% local: no data leaves the process.

import javax.crypto.Cipher;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.SecretKeySpec;
import java.security.SecureRandom;

public final class FileEncryptor {

    public static final int SALT_LENGTH = 16;
    public static final int IV_LENGTH = 12;
    public static final int ITERATIONS = 100_000;

    // GCM appends a 16-byte auth tag to the ciphertext; the smallest possible
    // encrypted payload is therefore salt + IV + tag = 44 bytes.
    private static final int TAG_LENGTH = 16;
    private static final int MIN_LENGTH = SALT_LENGTH + IV_LENGTH + TAG_LENGTH;

    private static final SecureRandom RANDOM = new SecureRandom();

    private FileEncryptor() {
    }

    /** PBKDF2-SHA256 (100k iterations) -> a raw AES-256 key. */
    private static SecretKeySpec deriveKey(char[] password, byte[] salt) throws Exception {
        PBEKeySpec spec = new PBEKeySpec(password, salt, ITERATIONS, 256);
        SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
        byte[] keyBytes = factory.generateSecret(spec).getEncoded();
        spec.clearPassword();
        return new SecretKeySpec(keyBytes, "AES");
    }

    /** Encrypt {@code data} under {@code password}. Returns salt || IV || ciphertext+tag. */
    public static byte[] encryptFile(byte[] data, String password) throws Exception {
        if (password.isEmpty()) {
            throw new IllegalArgumentException("Password must not be empty.");
        }
        if (data.length == 0) {
            throw new IllegalArgumentException("Input data is empty - nothing to encrypt.");
        }
        byte[] salt = new byte[SALT_LENGTH];
        byte[] iv = new byte[IV_LENGTH];
        RANDOM.nextBytes(salt);
        RANDOM.nextBytes(iv);

        SecretKeySpec key = deriveKey(password.toCharArray(), salt);
        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        cipher.init(Cipher.ENCRYPT_MODE, key, new GCMParameterSpec(128, iv));
        byte[] ciphertext = cipher.doFinal(data);

        byte[] out = new byte[SALT_LENGTH + IV_LENGTH + ciphertext.length];
        System.arraycopy(salt, 0, out, 0, SALT_LENGTH);
        System.arraycopy(iv, 0, out, SALT_LENGTH, IV_LENGTH);
        System.arraycopy(ciphertext, 0, out, SALT_LENGTH + IV_LENGTH, ciphertext.length);
        return out;
    }

    /**
     * Decrypt a payload produced by {@link #encryptFile}. Throws when the password
     * is wrong or the payload was corrupted/tampered (GCM auth-tag failure).
     */
    public static byte[] decryptFile(byte[] data, String password) throws Exception {
        if (password.isEmpty()) {
            throw new IllegalArgumentException("Password must not be empty.");
        }
        if (data.length < MIN_LENGTH) {
            throw new IllegalArgumentException("Input is too short to be an encrypted file"
                    + " (needs at least " + MIN_LENGTH + " bytes: salt + IV + auth tag).");
        }
        byte[] salt = java.util.Arrays.copyOfRange(data, 0, SALT_LENGTH);
        byte[] iv = java.util.Arrays.copyOfRange(data, SALT_LENGTH, SALT_LENGTH + IV_LENGTH);
        byte[] ciphertext = java.util.Arrays.copyOfRange(data, SALT_LENGTH + IV_LENGTH, data.length);

        SecretKeySpec key = deriveKey(password.toCharArray(), salt);
        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        cipher.init(Cipher.DECRYPT_MODE, key, new GCMParameterSpec(128, iv));
        try {
            return cipher.doFinal(ciphertext);
        } catch (Exception e) {
            // A GCM auth-tag failure means the key did not match (wrong password)
            // or the payload was modified after encryption.
            throw new IllegalArgumentException(
                    "Decryption failed: wrong password or corrupted file.", e);
        }
    }
}