An honest guide to AES-GCM vs encoding, local browser processing, passphrase strength, and what browser-based encryption can and cannot protect.