Uses AES-256-GCM authenticated encryption with a PBKDF2-derived key (100,000 iterations, SHA-256, random salt). All processing is done locally — your image never leaves your browser.