CryptAByte author here. The fundamental issue is whether you can trust server-side encryption. Theoretically you're right that you cannot absolutely trust my

CryptAByte author here. The fundamental issue is whether you can trust server-side encryption. Theoretically you're right that you cannot absolutely trust my service to do what it says it does. And I would not trust it relative to client-side software either. So, I would suggest that everyone use offline encryption, and my service exposes an API with offline encryption that works seamlessly with server-side encryption: https://cryptabyte.com/Service https://cryptabyte.com/Service Furthermore, I'm working on desktop apps which will do the encryption offline: https://cryptabyte.com/Home/Apps https://cryptabyte.com/Home/Apps But, for the average, non-technical user, the choice may be between not using encryption at all or relying on a poorly secured desktop environment and using my service. In that case, it may be more desirable to use my service than the alternative. Regarding key strength, my hope is that most people do not enter a password, allowing the software to generate it for them. For the self-destructing emails (https://cryptabyte.com/SelfDestruct https://cryptabyte.com/SelfDestruct), I do not allow entering the password, but generate a secure, 32 character passphrase.