File Encryption Examples in Python, JavaScript, Java and C#

JavaScript / Web Crypto API

For client-side encryption in JavaScript, the native window.crypto.subtle API is strictly recommended over older, unmaintained NPM packages like crypto-js.

AES-GCM Encryption in the Browser

AES-GCM is an authenticated encryption algorithm, meaning it offers both confidentiality and data origin authentication.

async function encryptData(text, password) {
  const enc = new TextEncoder();
  const iv = crypto.getRandomValues(new Uint8Array(12));
  
  // Derive key from password (PBKDF2 recommended for production)
  // Simplified for example using a raw key import
  const keyMaterial = await crypto.subtle.importKey(
    "raw", enc.encode(password.padEnd(32, '0').slice(0,32)), 
    {name: "AES-GCM"}, false, ["encrypt", "decrypt"]
  );

  const ciphertext = await crypto.subtle.encrypt(
    { name: "AES-GCM", iv: iv },
    keyMaterial,
    enc.encode(text)
  );

  return { iv, ciphertext };
}

How Do I Keep Encryption Keys Separate from Application Code in Javascript?

A frequent developer question. Never hardcode keys in your frontend JS.

• Node.js backend: Use `.env` files and the dotenv package. Never commit `.env` to source control.
• Frontend (Browser): Fetch ephemeral, user-selected keys from an authenticated backend API immediately before encryption, keep them in memory (never LocalStorage), and discard them when the session ends.
• Cloud Native: Use AWS KMS or Azure Key Vault to handle the cryptographic operations so the raw key never enters your application context.

C# .NET & Java Encryption

C# AES Encryption (.NET Library)

The System.Security.Cryptography namespace offers robust implementations. When you need to encrypt a C# PDF or standard file, Aes.Create() is the modern standard.

using System.Security.Cryptography;
using System.IO;

public static byte[] EncryptString(string plainText, byte[] Key, byte[] IV) {
    using (Aes aesAlg = Aes.Create()) {
        aesAlg.Key = Key;
        aesAlg.IV = IV;
        ICryptoTransform encryptor = aesAlg.CreateEncryptor(aesAlg.Key, aesAlg.IV);
        using (MemoryStream msEncrypt = new MemoryStream()) {
            using (CryptoStream csEncrypt = new CryptoStream(msEncrypt, encryptor, CryptoStreamMode.Write)) {
                using (StreamWriter swEncrypt = new StreamWriter(csEncrypt)) {
                    swEncrypt.Write(plainText);
                }
                return msEncrypt.ToArray();
            }
        }
    }
}

Advanced Client Deployment (USBs & Cloud)

When developers need to hand off sensitive project deliverables to clients, sending raw encrypted archives requires secure out-of-band key transmission. Commercial solutions streamline this workflow significantly.

Provisioning Portable USB Drives

Instead of writing batch scripts to decrypt archives on a client's machine, tools like Folder Lock can generate standalone executable vaults (often utilizing specialized extensions like .flka). These self-contained environments run directly from a USB flash drive or optical media on any standard Windows machine. The decryption engine is packaged alongside the data, meaning the recipient does not require administrative privileges or pre-installed software to access the deliverables.

Encrypted Cloud Synchronization

Relying on the native encryption provided by consumer cloud-based storage providers means trusting their server-side keys. A more robust architectural approach involves client-side encryption prior to synchronization. By pointing a dedicated vault tool at a local Google Drive, Dropbox, or OneDrive directory, files are mathematically obfuscated before they ever leave the local network. If the cloud provider experiences a breach, the exfiltrated data remains entirely unintelligible.