AES-GCM and Why Password-Based Encryption Needs PBKDF2
AES-GCM (Galois/Counter Mode) is a modern, authenticated encryption mode — it doesn't just encrypt data, it also generates a tag that detects whether the ciphertext was tampered with, which older AES modes (like plain CBC) don't provide on their own. This authentication matters because encryption without integrity checking can be vulnerable to certain tampering attacks that modify ciphertext in predictable ways.
A passphrase typed by a human isn't a valid AES key on its own — AES needs a fixed-length key of specific bit strength (256 bits here), and a short, memorable passphrase has far less entropy than that. PBKDF2 (Password-Based Key Derivation Function 2) bridges this gap by repeatedly hashing the passphrase (with a random salt) many thousands of times, which serves two purposes: it stretches the passphrase into a proper fixed-length key, and it deliberately slows down brute-force attacks against the passphrase itself, similar to how bcrypt/Argon2 protect stored passwords (see Password Hashing) for the same underlying reason.
All of this happens using the browser's native WebCrypto API — a well-audited, standard cryptographic implementation rather than a hand-rolled one, which matters a great deal for anything claiming to provide real security.