The cipher.ink source code, annotated

(function (root) {
  'use strict';
  var C = root.crypto, S = C.subtle;
  var te = new TextEncoder();
  var ITER = 600000;

function b64u(bytes) {
  var s = '', b = new Uint8Array(bytes);
  for (var i = 0; i < b.length; i += 0x8000) s += String.fromCharCode.apply(null, b.subarray(i, i + 0x8000));
  return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
}
function unb64u(str) {
  str = String(str).replace(/-/g, '+').replace(/_/g, '/');
  while (str.length % 4) str += '=';
  var s = atob(str), b = new Uint8Array(s.length);
  for (var i = 0; i < s.length; i++) b[i] = s.charCodeAt(i);
  return b;
}

function rand(n) { var b = new Uint8Array(n); C.getRandomValues(b); return b; }

function randInt(n) {
  var lim = Math.floor(4294967296 / n) * n, x = new Uint32Array(1);
  do C.getRandomValues(x); while (x[0] >= lim);
  return x[0] % n;
}

function norm(p) { return String(p).normalize('NFC'); }

async function passKey(pass, salt, iter) {
  var base = await S.importKey('raw', te.encode(norm(pass)), 'PBKDF2', false, ['deriveKey']);
  return S.deriveKey({ name: 'PBKDF2', hash: 'SHA-256', salt: salt, iterations: iter },
    base, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
}

function rawKey(bytes) {
  return S.importKey('raw', bytes, { name: 'AES-GCM' }, false, ['encrypt', 'decrypt']);
}

async function seal(obj, opt, files) {
  var iv = rand(12), p = { v: 2 }, key, linkKey = null, blobs = [];
  if (opt.link) {
    var kb = rand(32);
    if (opt.linkKey) kb = unb64u(opt.linkKey);
    key = await rawKey(kb);
    linkKey = b64u(kb);
    p.m = 'k';
  } else {
    var salt = rand(16);
    key = await passKey(opt.passphrase, salt, ITER);
    p.m = 'p'; p.it = ITER; p.s = b64u(salt);
  }
  if (files && files.length) {
    obj.att = [];
    for (var i = 0; i < files.length; i++) {
      var fiv = rand(12);
      blobs.push(new Uint8Array(await S.encrypt({ name: 'AES-GCM', iv: fiv }, key, files[i].bytes)));
      obj.att.push({ name: files[i].name, type: files[i].type, size: files[i].bytes.length, iv: b64u(fiv) });
    }
  }
  p.n = b64u(iv);
  p.c = b64u(await S.encrypt({ name: 'AES-GCM', iv: iv }, key, te.encode(JSON.stringify(obj))));
  return { payload: JSON.stringify(p), linkKey: linkKey, blobs: blobs };
}

async function open(payload, opt) {
  var p = typeof payload === 'string' ? JSON.parse(payload) : payload, key;
  if (p.v !== 2) throw new Error('format');
  if (p.m === 'k') key = await rawKey(unb64u(opt.linkKey));
  else key = await passKey(opt.passphrase, unb64u(p.s), p.it);
  var pt;
  try { pt = await S.decrypt({ name: 'AES-GCM', iv: unb64u(p.n) }, key, unb64u(p.c)); }
  catch (e) { throw new Error('wrong'); }
  return { data: JSON.parse(new TextDecoder().decode(pt)), key: key };
}

async function openFile(key, ivB64, bytes) {
  return new Uint8Array(await S.decrypt({ name: 'AES-GCM', iv: unb64u(ivB64) }, key, bytes));
}

async function legacyTry(bytes, ivt, pass) {
  var kb = te.encode(('x'.repeat(32) + pass).slice(-32));
  if (kb.length !== 32) return null;
  var key = await S.importKey('raw', kb, { name: 'AES-CBC' }, false, ['encrypt']);
  var blocks = Math.ceil(bytes.length / 16);
  var ks = new Uint8Array(await S.encrypt({ name: 'AES-CBC', iv: te.encode(ivt) }, key, new Uint8Array(blocks * 16)));
  var out = new Uint8Array(bytes.length);
  for (var i = 0; i < bytes.length; i++) out[i] = bytes[i] ^ ks[i];
  var s;
  try { s = new TextDecoder('utf-8', { fatal: true }).decode(out); } catch (e) { return null; }
  if (/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(s)) return null;
  return s.replace(/\s+$/, '');
}
async function legacyOpen(bytes, ivt, pass) {
  pass = String(pass).replace(/\n/g, '');
  var tries = [pass.toLowerCase().substr(0, 32)];
  if (pass.substr(0, 32) !== tries[0]) tries.push(pass.substr(0, 32));
  for (var i = 0; i < tries.length; i++) {
    var r = await legacyTry(bytes, ivt, tries[i]);
    if (r !== null) return { html: r };
  }
  throw new Error('wrong');
}

async function sha256hex(str) {
  var h = new Uint8Array(await S.digest('SHA-256', te.encode(str)));
  return Array.prototype.map.call(h, function (x) { return ('0' + x.toString(16)).slice(-2); }).join('');
}

root.Cipher = { seal: seal, open: open, openFile: openFile, legacyOpen: legacyOpen, b64u: b64u, unb64u: unb64u,
  rand: rand, randInt: randInt, sha256hex: sha256hex, ITER: ITER };

form.addEventListener('submit', async function (e) {
  e.preventDefault();
  if (btn.disabled) return;
  err.textContent = '';
  var pass = passEl.value;
  if (D.mode === 'k' && !linkKey) {
    linkKey = keyFrom($('#keyin').value);
    if (!linkKey) return fail('That doesn’t contain a key. It is the long part after the #.');
  }
  if (D.mode === 'p' && !pass) { passEl.focus(); return fail('Enter the passphrase you were given.'); }
  btn.disabled = true; btn.classList.add('busy');
  btn.querySelector('.lbl').textContent = D.mode === 'p' && D.kind === 'v2' ? 'Deriving key…' : 'Unsealing…';

  if (!payload && D.kind === 'v2') {
    try {
      var r = await App.post('open', { id: D.id });
      payload = r.payload; burned = r.burned;
    } catch (x) {
      if (x.status === 404) return gone();
      return fail(x.message || 'Could not reach the server.');
    }
  }
  var obj, key = null;
  try {
    if (D.kind === 'legacy') obj = await Cipher.legacyOpen(JSON.parse(D.enc), D.id, pass);
    else { var o = await Cipher.open(payload, D.mode === 'k' ? { linkKey: linkKey } : { passphrase: pass }); obj = o.data; key = o.key; }
  } catch (x) {
    if (D.mode === 'k') { linkKey = null; $('#keyrow').hidden = false; return fail('That key doesn’t open this message. Check you copied the whole link.'); }
    return fail(burned
      ? 'Not that one. The server copy is already destroyed, so it lives only in this tab now. Keep trying, and don’t close it.'
      : 'That passphrase doesn’t open it.');
  }
  // A Secret Santa card opened through its /m/ link: hand over to the card page, which records the open itself.
  if (obj && obj.app === 'santa' && D.mode === 'k') { location.replace(D.base + 'santa/' + D.id + '#' + linkKey); return; }
  // Read receipt: only a successful unseal counts (link-preview bots can't decrypt). Burn messages
  // were counted when the server handed them over. The sender previewing their own message (it is in
  // this browser's My messages) is not a read.
  var mine = App.sent.list().some(function (x) { return x.id === D.id; });
  if (D.kind === 'v2' && !burned && obj.d && !mine) App.post('opened', { id: D.id, token: obj.d }).catch(function () {});
  reveal(obj, key);
});

var TAGS = ['p', 'br', 'b', 'strong', 'i', 'em', 'u', 's', 'strike', 'del', 'h1', 'h2', 'h3',
  'blockquote', 'ul', 'ol', 'li', 'pre', 'code', 'a', 'hr', 'div'];
if (root.DOMPurify) {
  DOMPurify.addHook('afterSanitizeAttributes', function (n) {
    if (n.tagName !== 'A') return;
    var h = n.getAttribute('href') || '';
    if (!/^(https?:|mailto:)/i.test(h)) n.removeAttribute('href');
    else { n.setAttribute('target', '_blank'); n.setAttribute('rel', 'noopener noreferrer nofollow'); }
  });
}
App.sanitize = function (html) {
  if (!root.DOMPurify) throw new Error('sanitizer missing');
  return DOMPurify.sanitize(html, { ALLOWED_TAGS: TAGS, ALLOWED_ATTR: ['href'] });
};

// No inline script, nothing from another origin but the feedback tab's server ($fb, in script-src and connect-src only).
// Decrypted messages are rendered as HTML, so this is the second wall behind DOMPurify. blob: is for decrypted image
// attachments. worker-src: the tools hash big files and run the sieve in Web Workers (same-origin files only).
header("Content-Security-Policy: default-src 'none'; script-src 'self'$fb; style-src 'self'; " .
  "font-src 'self'; img-src 'self' data: blob:; connect-src 'self'$fb; worker-src 'self'; base-uri 'none'; " .
  "form-action 'self'; manifest-src 'self'; frame-ancestors 'none'");