AES-256-GCM
Authenticated encryption — tampering is detected, not silently accepted.
PBKDF2 keys
Passphrases become keys; 250,000 iterations by default.
Sealed envelope
salt + iv + ciphertext as bytes or base64 — portable and self-contained.
One-time view
Seal with a random key and delete it after the first open.
Never hand-roll cryptography. This is the one place it lives.