AES‑256‑GCM encryption with passphrase/key, portable package, Copy/PDF/TXT export.
If empty, a random 256‑bit key will be generated for you.
Exactly 32 bytes (base64). Overrides passphrase if provided.