Offline, zero-persistence AES‑256‑CBC (default) encryption/decryption. AES‑GCM is also supported. No data is saved or sent anywhere.