Sonic Cipher

AES-256-GCM for the text, ggwave for the air. Start listen on the other device first. Default profile is for radio and phone lines — other modes often fail on those links.

1. Encrypt & play

Default is DT slow, a narrow band for walkie-talkies and phone lines (~1.1–2.6 kHz). Try DT fast only after slow decodes. MT is even narrower. Audible and ultrasonic modes need a wider, cleaner path (same-room speaker to mic). Many radios, landlines, and voice-call codecs will not decode those other modes.

2. Listen & decrypt

modem… mic idle waiting

3. Encrypt / decrypt as text

Same passphrase and SC2 packet as audio. No sound. Paste ciphertext here to decrypt.

Log

What is this for?

Run it from the hosted page (https://markdaman1236.github.io/Sonic-Cipher/) or download this HTML file and open it locally. Nothing is installed and nothing is uploaded.

Two people who share a passphrase can send a short encrypted note as sound — phone speaker to phone mic — or as copy-paste ciphertext.

Use cases

  • Radio / ham / analog links — play the tone into a transceiver or walkie-talkie; the far side holds a phone to the speaker and decrypts. Useful when you have voice but not a data channel.
  • Mobile phone calls — put the call on speaker, play on one handset, listen on the other. Works across ordinary GSM/VoLTE voice, not only in the same room.
  • VoIP / video calls — same idea over FaceTime, Signal, Zoom, Teams, or a radio app. The ciphertext rides the audio mix.
  • Air-gap / same room — pass a note between laptops or phones with no cable, QR, or network.
  • Text packet — encrypt to an SC2. string and send that over SMS, email, chat, or paper if sound is a bad path.

Technical summary

  • Confidentiality / integrity: AES-256-GCM via Web Crypto. Random 16-byte salt, 12-byte IV, 16-byte message id. Version, id, and timestamp are bound as AAD so headers cannot be swapped.
  • Key: PBKDF2-HMAC-SHA-256, 600 000 iterations, from a shared passphrase (12+ characters). Strength tracks the passphrase, not a public-key identity.
  • Freshness: millisecond timestamp; packets outside ±10 minutes are rejected. Duplicate ids on this page are logged but still shown.
  • Air layer: bundled ggwave (FSK + Reed–Solomon). Default is dual-tone slow (narrow band for radio and phone lines), with DT/MT fast and fastest as quicker options on the same band. Also audible and ultrasonic at slow / medium / fast / ultrafast. Those wider modes often fail on walkie-talkies, landlines, and compressed voice calls. Faster DT/MT is still narrow-band, but shorter tones drop more easily on VOX, AGC, and compressed voice. Long payloads are split into 80-character frames and reassembled.
  • Compatibility: legacy SC1 blobs still decrypt. Current packets are SC2. Mic capture needs HTTPS or localhost; playback works from a saved file.

What it runs on

  • iPhone / iPad — Safari or any browser that can open a local HTML file or a hosted page. Grant the microphone when listening. Raise playback volume; iOS speakers are often quiet. FaceTime and cellular calls work if the far end can hear the tones.
  • Android — Chrome, Firefox, or Samsung Internet. Same file. Allow the mic; turn off extra noise suppression in the browser if decode is flaky.
  • Desktop / laptop — Chrome, Edge, Firefox, or Safari on Windows, macOS, or Linux. A real speaker and mic beat a Bluetooth headset for ggwave.
  • Other — any device with a modern browser and Web Crypto + Web Audio (Chromebooks, some smart TVs/kiosks). No native app and no install. Mic capture needs HTTPS or localhost; opening a saved .html is enough for encrypt / play / text decrypt.

Both sides must use the same HTML revision, the same passphrase, and the same speed profile. Listen first, then play. Hold PTT for the whole playback on a radio, including gaps between frames. Ultrasonic modes need speakers and mics that still respond above ~15 kHz — many phones do not. Audible and ultrasonic profiles use a ~4.5 kHz-wide band that many radios and phone lines will not pass.