Encrypts text with AES-256-GCM (PBKDF2 100k SHA-256 iterations) and embeds the ciphertext inside the URL #hash fragment. Because browsers never send #hash fragments over the network, neither the server nor any logs ever see your payload.