v5 Container — Argon2id (64MB, t=4, p=4) → HKDF-SHA256 → AES-256-GCM with authenticated header.
Optional Ed25519 signatures verified before decryption. No server. No CDN. No network calls.
All cryptographic operations use the browser's native WebCrypto API.
Old v4 containers are not supported.