I've just created a web app for encrypting data into url. The intent is to encrypt data at the client side without leaking the plain data to any server. The e

I've just created a web app for encrypting data into url. The intent is to encrypt data at the client side without leaking the plain data to any server. The encrypted data are packed into a url for easy sharing. Decryption is done on the browser with a password. SJCL is used as the workhorse for encryption. I know there's a prevalent view against doing crypto stuff in Javascript so extra precautions are taken to minimize the security risks. - All web content (html, css, js, images) come from the same server. - No download from any 3rd party websites or CDN. - Use SSL certificate for all content to prevent code injection along the way. - Encryption and decryption are done on the browser. - Nothing is submitted to the server and no input shown to avoid XSS. - Url fragment is used for encrypted data which stays on browser. - Server doesn't do any encryption work besides serving the web content. - The web pages can be downloaded and run off from the local file system. - Have as few dependencies as possible, just: SJCL, Bootstrap (css), and html5.js. - Keep things simple for verification. Please review the app and code to see if there are any security concerns. Thanks!