Encrypts plaintext with AES-256-GCM using the provided CryptoKey.
Generates a fresh random IV (12 bytes) for every call — reusing an IV with the same key in GCM mode catastrophically compromises confidentiality.
The returned ciphertext includes the 16-byte GCM tag as its last 16 bytes; no separate authTag field is needed.
CryptoKey imported via importAeadKey.
The data to encrypt.
AeadResult with ciphertext (tag included) and IV.
'ENCRYPTION_FAILED' if WebCrypto encrypt fails.
const { ciphertext, iv } = await encryptAead(key, secretData);// store/transmit ciphertext + iv together Copy
const { ciphertext, iv } = await encryptAead(key, secretData);// store/transmit ciphertext + iv together
Encrypts plaintext with AES-256-GCM using the provided CryptoKey.
Generates a fresh random IV (12 bytes) for every call — reusing an IV with the same key in GCM mode catastrophically compromises confidentiality.
The returned ciphertext includes the 16-byte GCM tag as its last 16 bytes; no separate authTag field is needed.