Paragraph-granular encryption

mdenc splits Markdown on blank lines and encrypts each paragraph independently with XChaCha20-Poly1305. Change one paragraph and only that chunk's ciphertext changes.

Deterministic ciphertext

Nonces are derived from HMAC-SHA256(key, plaintext), not random. Same password + same text = same output. This makes encrypted files produce clean git diffs.

File format

mdenc:v1 salt_b64=... file_id_b64=... scrypt=N=...,r=...,p=...
hdrauth_b64=<HMAC-SHA256 of header>
<base64 chunk: nonce ‖ ciphertext ‖ tag>
<base64 chunk: nonce ‖ ciphertext ‖ tag>
seal_b64=<HMAC-SHA256 of all lines above>

Git integration

Uses git's native smudge/clean filter. Your working directory stays plaintext; git objects store ciphertext. Diffs show plaintext via textconv.

Color coding

Each color above maps a plaintext paragraph to its encrypted chunk. Edit a paragraph and watch only the matching chunk change.