Thanks so much for the feedback! Based on this and tptacek's comment,[0] I will likely remove the ability to disable randomizing the IV in future versions. Luck

Thanks so much for the feedback! Based on this and tptacek's comment,[0] I will likely remove the ability to disable randomizing the IV in future versions. Luckily, this will not break any encrypted links generated thus far. Unless I am misunderstanding your comment, I do actually use TextEncoder and TextDecoder objects for doing some ascii <-> Uint8Array conversion in the base64 library I wrote,[1] but I have found that they are not actually inverses, leading me to minimize their use. To be fair, I may just be doing something incorrectly. However, in a number of my test cases, I have found the following to be true: (new TextDecoder).decode((new TextEncoder).encode(someText)) != someText Also, note that if the base64 decoding fails, there will be an error shown explaining that the encoded URL appears corrupted. Does this address what you mean about the password being transformed to bytes via base64? [0]: https://news.ycombinator.com/item?id=23253488 https://news.ycombinator.com/item?id=23253488 [1]: https://github.com/jstrieb/link-lock/blob/master/b64.js#L41 https://github.com/jstrieb/link-lock/blob/master/b64.js#L41