[.ENC FILE FORMAT SPECIFICATION]

┌────────────────────────────┐
│  Header          256 bytes │  fixed size, unencrypted
├────────────────────────────┤
│  Ciphertext      variable  │  encrypted in 2 MiB chunks
├────────────────────────────┤
│  Auth tag         32 bytes │  HMAC-SHA256 over the ciphertext
└────────────────────────────┘

The header is deliberately left unencrypted so that a reader can determine the algorithm and key-derivation method before it has a key. It contains no secret material: the salt and IV are not secrets, and the original filename is the only potentially sensitive field.

The plaintext is read in 2 MiB (2,097,152-byte) chunks and each chunk is encrypted independently as an AEAD ciphertext, which keeps memory use flat regardless of file size. Every chunk therefore carries its own 16-byte authentication tag, so a chunk on disk occupies 2 MiB + 16 bytes. If the compression flag is set, the whole file is DEFLATE-compressed before chunking; compression is applied only when it actually reduces the size.

Three mechanisms protect a v2 file, and a reader must honour all of them:

• Key separation. The master key is never used directly. HKDF-SHA256 derives two independent subkeys, with the file's IV as the HKDF salt and the ASCII labels ENCF/v2/cipher and ENCF/v2/mac as info.
• Per-chunk AEAD. The nonce is the 12-byte IV with the big-endian chunk index XORed into its last four bytes. The associated data is the entire 256-byte header followed by the big-endian chunk index — so the filename, IV, algorithm byte, compression flag and chunk ordering are all authenticated.
• Trailer. The final 32 bytes are HMAC-SHA256 over header ‖ ciphertext, keyed with the MAC subkey. This catches truncation.

Enough to identify a file and route it correctly:

const head = new Uint8Array(await file.slice(0, 256).arrayBuffer());

const magic = String.fromCharCode(...head.subarray(0, 4));
if (magic !== 'ENCF') throw new Error('Not an ENCF file');

const version    = head[4] + '.' + head[5];
const algorithm  = head[6];               // 1 = AES-256, 2 = ChaCha20-Poly1305
const kdf        = head[7];               // 1 = PBKDF2, 3 = random, 4 = user key
const salt       = head.subarray(8, 40);
const iv         = head.subarray(40, 52);
const nameLen    = head[52] | (head[53] << 8);
const name       = new TextDecoder().decode(head.subarray(54, 54 + nameLen));
const compressed = head[254] === 0x01;