From a96ba665acb299d325c89c2b498e33f4c6126156 Mon Sep 17 00:00:00 2001
From: Cell <1024@lruihao.cn>
Date: Sun, 5 Jul 2026 23:26:11 +0800
Subject: [PATCH] refactor(assets)!: rewrite content encryption with
 AES-256-GCM and PBKDF2 (#806)

* refactor(assets)!: rewrite content encryption with AES-256-GCM and PBKDF2

- Remove legacy Base64 obfuscation layer (content-encryption.html)
- Replace <cipher-text> with <template> for inert content storage
- Single-layer AES-256-GCM encryption via post-build script
- PBKDF2 key derivation (100k iterations) for encryption
- PBKDF2-protected password verification (data-verify-salt)
- Depth-tracking parser for nested shortcode support
- Dev mode: plaintext content used directly without encryption
- Remove crypto-js and xxhash-wasm vendored dependencies

* feat(post-encrypt): prepare package for npm publishing

- Add bin entry, build script, and dist output for npx usage
- Replace @hugo-fixit/shared with standalone implementations
- Add CLI shebang for direct execution
- Add package README with usage documentation
- Remove FIXIT_ENCRYPT_INPUT env var (redundant with --input)
- Add encryption detection warning in assets.html
- Remove Post-build Encryption sections from READMEs

* chore: integrate post-encrypt into build pipeline and use consola

- Replace console with consola for post-encrypt logging
- Improve verification messages (no templates, count, etc.)
- Simplify build scripts: encrypt runs as part of main build
- Update encryption detection warning to use npx command

* feat(assets): add encryption dev warning admonition

- Add danger admonition in single.html for full-page encryption (dev mode only)
- Add encryption detection warning in assets.html console
- Improve post-encrypt verification messages with template count

* feat(assets): improve encryption i18n, cache security, and error handling

- Add encryptionWarning and encryptionCommand i18n keys for all 16 languages
- Store PBKDF2 verification hash in localStorage cache for better security
- Show decryption errors via flashTooltip instead of console only
- Add FixItDecryptor type definitions in global.ts
- Move encryption detection to init/detection-encryption.html with batched warning
- Remove redundant per-page warning from assets.html

* feat(assets): redesign fixit-decryptor UI with card layout

- Page-level: card form with lock icon header, password input with key icon, primary-colored unlock button, circular re-encrypt button
- Shortcode-level: connected input+button design (search bar style) with focus ring sync
- Remove loading spinner, use display:none/flex toggle via .initialized class
- Move lock icon styling to UnoCSS (text-primary text-xl)
- Initialize CellTooltip on re-encrypt button
- Fix JSDoc @param warnings in global.ts

* refactor(assets): unify TOC template and decryptor animations

- TOC always rendered in `<template data-toc>`, containers populated by initToc()
- Moved TOC scroll/resize handling from events.ts to toc.ts (syncTocLayout, syncTocActiveState)
- Removed EventsModule toc dependency, updated public-api.ts constructor
- Removed visibility:hidden from #toc-auto
- Decryptor: form always visible, @starting-style for fade-in on init
- Decryptor: content expand/collapse animation using height + opacity
- Removed encrypted-hidden from TOC elements in single.html

* refactor(assets): add target to fixit:decrypted event and simplify handlers

- Add { target: Element } payload to fixit:decrypted in event-bus.ts
- Remove $content closure from fixit-decryptor init(), use detail.target
- Update content.ts and toc.ts to use detail.target from event

* fix(assets): use eventBus for TOC scroll/resize listeners and eliminate redundant template parsing

- Replace raw window scroll/resize listeners in TocModule with eventBus
  subscriptions (fixit:scroll/fixit:resize), reusing EventsModule's
  throttle and debounce instead of duplicating un-throttled handlers.
- Refactor hasUnencryptedTemplate in post-encrypt to accept the already-
  computed matches array, avoiding a redundant findEncryptionTemplates
  call on the same HTML content.
- Remove crypto-js and xxhash-wasm from README credits.

* style(assets): soften decryptor button background and add form hover shadow

* build(workflow): add post-encrypt step to build script
---
 .gitignore                                    |   3 +
 README.md                                     |   2 -
 README.zh-cn.md                               |   2 -
 assets/css/unocss.css                         |   3 +
 assets/data/cdn/jsdelivr.yml                  |   6 -
 assets/data/cdn/unpkg.yml                     |   6 -
 assets/js/core/event-bus.ts                   |   2 +-
 assets/js/core/public-api.ts                  |   2 +-
 assets/js/lib/fixit-decryptor.ts              | 224 ++++-
 assets/js/modules/content.ts                  |   7 +-
 assets/js/modules/encryption.ts               |   2 +-
 assets/js/modules/events.ts                   |   8 +-
 assets/js/modules/toc.ts                      |  75 +-
 assets/js/types/global.ts                     |  23 +-
 assets/lib/crypto-js/core.js                  | 807 ------------------
 assets/lib/crypto-js/enc-base64.js            | 136 ---
 assets/lib/crypto-js/sha256.js                | 199 -----
 assets/lib/xxhash-wasm/xxhash-wasm.js         |   1 -
 assets/scss/pages/posts/_toc.scss             |   1 -
 .../scss/pages/shared/_fixit-decryptor.scss   | 227 +++--
 build.sh                                      |   4 +
 hugo.toml                                     |   8 +
 i18n/de.toml                                  |   2 +
 i18n/en.toml                                  |   2 +
 i18n/es.toml                                  |   2 +
 i18n/fr.toml                                  |   2 +
 i18n/hi.toml                                  |   2 +
 i18n/it.toml                                  |   2 +
 i18n/ja.toml                                  |   2 +
 i18n/ko.toml                                  |   2 +
 i18n/pl.toml                                  |   2 +
 i18n/pt-BR.toml                               |   2 +
 i18n/ro.toml                                  |   2 +
 i18n/ru.toml                                  |   2 +
 i18n/sr.toml                                  |   2 +
 i18n/vi.toml                                  |   2 +
 i18n/zh-CN.toml                               |   2 +
 i18n/zh-TW.toml                               |   2 +
 layouts/_partials/base/assets.html            |   8 -
 .../function/content-encryption.html          |  15 -
 .../_partials/init/detection-encryption.html  |  11 +
 layouts/_partials/init/index.html             |   1 +
 layouts/_partials/plugin/fixit-encryptor.html |  34 +-
 layouts/posts/single.html                     |  19 +-
 librarybot.yml                                |  16 -
 package.json                                  |   3 +-
 packages/chroma-lexers/src/index.ts           |   2 +
 packages/post-encrypt/README.md               |  54 ++
 packages/post-encrypt/package.json            |  39 +
 packages/post-encrypt/src/index.ts            | 313 +++++++
 packages/post-encrypt/tsconfig.json           |  14 +
 pnpm-lock.yaml                                |   6 +
 52 files changed, 917 insertions(+), 1398 deletions(-)
 delete mode 100644 assets/lib/crypto-js/core.js
 delete mode 100644 assets/lib/crypto-js/enc-base64.js
 delete mode 100644 assets/lib/crypto-js/sha256.js
 delete mode 100644 assets/lib/xxhash-wasm/xxhash-wasm.js
 delete mode 100644 layouts/_partials/function/content-encryption.html
 create mode 100644 layouts/_partials/init/detection-encryption.html
 create mode 100644 packages/post-encrypt/README.md
 create mode 100644 packages/post-encrypt/package.json
 create mode 100644 packages/post-encrypt/src/index.ts
 create mode 100644 packages/post-encrypt/tsconfig.json

diff --git a/.gitignore b/.gitignore
index b85bd162..ddc722a1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,9 @@ jsconfig.json
 public/
 resources/
 
+# packages
+dist/
+
 # NPM
 node_modules/
 .eslintcache
diff --git a/README.md b/README.md
index 3c667850..f5aa8429 100644
--- a/README.md
+++ b/README.md
@@ -303,9 +303,7 @@ Thanks to the [Hugo DoIt](https://github.com/HEIGE-PCloud/DoIt) theme and [Hexo
 - [Twikoo](https://twikoo.js.org/)
 - [github-corners](https://github.com/tholman/github-corners)
 - [giscus](https://giscus.app/zh-CN)
-- [crypto-js](https://github.com/brix/crypto-js)
 - [pace](https://github.com/CodeByZach/pace)
-- [xxhash-wasm](https://github.com/jungomi/xxhash-wasm)
 - [`<tab-container>` element](https://github.com/github/tab-container-element)
 - [`<json-viewer>` element](https://github.com/Lruihao/json-viewer-element)
 
diff --git a/README.zh-cn.md b/README.zh-cn.md
index b78e5b42..a6cd6dcc 100644
--- a/README.zh-cn.md
+++ b/README.zh-cn.md
@@ -303,9 +303,7 @@ FixIt 主题多语言基本配置及自动翻译等详见 [内容管理](https:/
 - [Twikoo](https://twikoo.js.org/)
 - [github-corners](https://github.com/tholman/github-corners)
 - [giscus](https://giscus.app/zh-CN)
-- [crypto-js](https://github.com/brix/crypto-js)
 - [pace](https://github.com/CodeByZach/pace)
-- [xxhash-wasm](https://github.com/jungomi/xxhash-wasm)
 - [`<tab-container>` element](https://github.com/github/tab-container-element)
 - [`<json-viewer>` element](https://github.com/Lruihao/json-viewer-element)
 
diff --git a/assets/css/unocss.css b/assets/css/unocss.css
index 607156be..6e1108da 100644
--- a/assets/css/unocss.css
+++ b/assets/css/unocss.css
@@ -12,6 +12,7 @@
 /* layer: shortcuts */
 .z-fixed{z-index:200;}
 /* layer: default */
+.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border-width:0;}
 .visible{visibility:visible;}
 .absolute{position:absolute;}
 .fixed{position:fixed;}
@@ -33,6 +34,7 @@
 .my-4{margin-top:1rem;margin-bottom:1rem;}
 .me{margin-inline-end:1rem;}
 .me-1{margin-inline-end:0.25rem;}
+.me-1\.5{margin-inline-end:0.375rem;}
 .me-2{margin-inline-end:0.5rem;}
 .ms-1{margin-inline-start:0.25rem;}
 .inline{display:inline;}
@@ -94,6 +96,7 @@
 }
 @media (max-width: 679.9px){
 .max-sm\:hidden{display:none;}
+.max-sm\:w-full{width:100%;}
 }
 @media (min-width: 680px){
 .sm\:hidden{display:none;}
diff --git a/assets/data/cdn/jsdelivr.yml b/assets/data/cdn/jsdelivr.yml
index 2b593922..d4747fee 100644
--- a/assets/data/cdn/jsdelivr.yml
+++ b/assets/data/cdn/jsdelivr.yml
@@ -25,10 +25,6 @@ libFiles:
   # cookieconsent@3.1.1 https://github.com/osano/cookieconsent
   cookieconsentCSS: cookieconsent@3.1.1/build/cookieconsent.min.css
   cookieconsentJS: cookieconsent@3.1.1/build/cookieconsent.min.js
-  # crypto-js@4.2.0 https://github.com/brix/crypto-js
-  cryptoCoreJS: crypto-js@4.2.0/core.js
-  cryptoEncBase64JS: crypto-js@4.2.0/enc-base64.js
-  cryptoSha256JS: crypto-js@4.2.0/sha256.js
   # echarts@6.1.0 https://github.com/apache/echarts
   echartsJS: echarts@6.1.0/dist/echarts.min.js
   # @fortawesome/fontawesome-free@7.3.0 https://github.com/FortAwesome/Font-Awesome
@@ -76,5 +72,3 @@ libFiles:
   # @waline/client@3.15.2 https://github.com/walinejs/waline
   walineCSS: '@waline/client@3.15.2/dist/waline.css'
   walineJS: '@waline/client@3.15.2/dist/waline.umd.js'
-  # xxhash-wasm@1.1.0 https://github.com/jungomi/xxhash-wasm
-  xxhashWasmJS: xxhash-wasm@1.1.0/umd/xxhash-wasm.js
diff --git a/assets/data/cdn/unpkg.yml b/assets/data/cdn/unpkg.yml
index 1f2b6e2d..48f1c6af 100644
--- a/assets/data/cdn/unpkg.yml
+++ b/assets/data/cdn/unpkg.yml
@@ -25,10 +25,6 @@ libFiles:
   # cookieconsent@3.1.1 https://github.com/osano/cookieconsent
   cookieconsentCSS: cookieconsent@3.1.1/build/cookieconsent.min.css
   cookieconsentJS: cookieconsent@3.1.1/build/cookieconsent.min.js
-  # crypto-js@4.2.0 https://github.com/brix/crypto-js
-  cryptoCoreJS: crypto-js@4.2.0/core.js
-  cryptoEncBase64JS: crypto-js@4.2.0/enc-base64.js
-  cryptoSha256JS: crypto-js@4.2.0/sha256.js
   # echarts@6.1.0 https://github.com/apache/echarts
   echartsJS: echarts@6.1.0/dist/echarts.min.js
   # @fortawesome/fontawesome-free@7.3.0 https://github.com/FortAwesome/Font-Awesome
@@ -76,5 +72,3 @@ libFiles:
   # @waline/client@3.15.2 https://github.com/walinejs/waline
   walineCSS: '@waline/client@3.15.2/dist/waline.css'
   walineJS: '@waline/client@3.15.2/dist/waline.umd.js'
-  # xxhash-wasm@1.1.0 https://github.com/jungomi/xxhash-wasm
-  xxhashWasmJS: xxhash-wasm@1.1.0/umd/xxhash-wasm.js
diff --git a/assets/js/core/event-bus.ts b/assets/js/core/event-bus.ts
index 5284364a..2d477ae8 100644
--- a/assets/js/core/event-bus.ts
+++ b/assets/js/core/event-bus.ts
@@ -3,7 +3,7 @@ export interface FixItEventMap {
   'fixit:switch-theme': { isDark: boolean, mode: string, isChanged: boolean }
   'fixit:scroll': void
   'fixit:resize': void
-  'fixit:decrypted': void
+  'fixit:decrypted': { target: Element }
   'fixit:partial-decrypted': { target: Element }
   'fixit:re-encrypt': void
   'fixit:code-tab-sync': { lang: string, source: HTMLElement }
diff --git a/assets/js/core/public-api.ts b/assets/js/core/public-api.ts
index 3326ce3b..9170848c 100644
--- a/assets/js/core/public-api.ts
+++ b/assets/js/core/public-api.ts
@@ -43,7 +43,7 @@ export class PublicAPI implements FixItPublicAPI {
     this.pwa = new PWAModule(this.core)
     this.misc = new MiscModule(this.core)
     this.content = new ContentModule(this.core, this.code)
-    this.events = new EventsModule(this.core, this.toc, this.code)
+    this.events = new EventsModule(this.core, this.code)
   }
 
   get config() { return this.core.config }
diff --git a/assets/js/lib/fixit-decryptor.ts b/assets/js/lib/fixit-decryptor.ts
index faebf0f4..ed206054 100644
--- a/assets/js/lib/fixit-decryptor.ts
+++ b/assets/js/lib/fixit-decryptor.ts
@@ -2,16 +2,21 @@
  * Encrypted content decryptor for FixIt pages and shortcodes.
  *
  * Responsibilities:
- * - Validate password input and decrypt Base64 payloads into target containers.
+ * - Validate password input and decrypt AES-256-GCM payloads into target containers.
  * - Support both full-page and shortcode-scoped encrypted blocks.
  * - Persist and validate page-level decrypt cache with expiration.
  * - Emit and react to FixIt events for decrypted/partial-decrypted/reset flows.
+ *
+ * Encrypted payloads are stored in `<template data-password="..." data-cipher="...">` elements.
+ * Using `<template>` prevents the browser from rendering inner content (mermaid, echarts, etc.).
+ *
+ * Payload formats:
+ * - v2 (current): PBKDF2(SHA-256(password), 100k iterations) → base64(salt).base64(iv).base64(ciphertext+tag)
+ * - Password verification: data-password stores PBKDF2(SHA-256(password), data-verify-salt) when post-encrypted
  */
 import { eventBus } from '../core/event-bus'
 import { flashTooltip } from '../utils'
 
-declare const CryptoJS: any
-
 interface DecryptorOptions {
   duration?: number
 }
@@ -19,9 +24,12 @@ interface DecryptorOptions {
 interface CachedStat {
   expiration: number
   password: string
-  salt: string
+  /** SHA-256 hash of the password, used for AES key derivation */
+  sha256: string
 }
 
+const PBKDF2_ITERATIONS = 100_000
+
 class FixItDecryptor {
   options: Required<DecryptorOptions>
 
@@ -33,45 +41,112 @@ class FixItDecryptor {
   constructor(options: DecryptorOptions = {}) {
     this.options = { duration: options.duration || 24 * 60 * 60 }
     customElements.get('fixit-encryptor') || customElements.define('fixit-encryptor', class extends HTMLElement {})
-    customElements.get('cipher-text') || customElements.define('cipher-text', class extends HTMLElement {})
   }
 
   /**
-   * Decode Base64 cipher text and inject the decrypted HTML into the target.
-   * @param $cipherText - The `<cipher-text>` element containing the encrypted content.
-   * @param $target - The DOM element to inject decrypted HTML into.
-   * @param salt - The salt string derived from the password.
+   * Decrypt a v2 payload using PBKDF2 key derivation.
+   * Format: base64(salt).base64(iv).base64(ciphertext+tag)
    */
-  #decryptContent($cipherText: HTMLElement, $target: HTMLElement, salt: string) {
+  async #decryptV2(payload: string, passwordHash: string): Promise<string> {
+    const [saltBase64, ivBase64, encryptedBase64] = payload.split('.', 3)
+    if (!saltBase64 || !ivBase64 || !encryptedBase64) {
+      throw new Error('Invalid v2 payload format: expected 3 segments')
+    }
+
+    const salt = Uint8Array.from(atob(saltBase64), c => c.charCodeAt(0))
+    const iv = Uint8Array.from(atob(ivBase64), c => c.charCodeAt(0))
+    const encrypted = Uint8Array.from(atob(encryptedBase64), c => c.charCodeAt(0))
+
+    const passwordBytes = new TextEncoder().encode(passwordHash)
+    const baseKey = await crypto.subtle.importKey('raw', passwordBytes, 'PBKDF2', false, ['deriveKey'])
+    const aesKey = await crypto.subtle.deriveKey(
+      { name: 'PBKDF2', salt, iterations: PBKDF2_ITERATIONS, hash: 'SHA-256' },
+      baseKey,
+      { name: 'AES-GCM', length: 256 },
+      false,
+      ['decrypt'],
+    )
+
+    const plainBuffer = await crypto.subtle.decrypt(
+      { name: 'AES-GCM', iv, tagLength: 128 },
+      aesKey,
+      encrypted,
+    )
+
+    return new TextDecoder().decode(plainBuffer)
+  }
+
+  async #sha256Hex(input: string): Promise<string> {
+    const bytes = new TextEncoder().encode(input)
+    const hashBuffer = await crypto.subtle.digest('SHA-256', bytes)
+    return Array.from(new Uint8Array(hashBuffer))
+      .map(byte => byte.toString(16).padStart(2, '0'))
+      .join('')
+  }
+
+  /**
+   * Derive a verification hash using PBKDF2 from a SHA-256 password hash.
+   */
+  async #deriveVerifyHash(passwordHash: string, salt: ArrayBuffer): Promise<string> {
+    const passwordBytes = new TextEncoder().encode(passwordHash)
+    const baseKey = await crypto.subtle.importKey('raw', passwordBytes, 'PBKDF2', false, ['deriveBits'])
+    const bits = await crypto.subtle.deriveBits(
+      { name: 'PBKDF2', salt, iterations: PBKDF2_ITERATIONS, hash: 'SHA-256' },
+      baseKey,
+      256,
+    )
+    return Array.from(new Uint8Array(bits))
+      .map(byte => byte.toString(16).padStart(2, '0'))
+      .join('')
+  }
+
+  async #decryptContent($template: HTMLTemplateElement, $target: HTMLElement, passwordHash: string): Promise<void> {
     try {
-      $target.innerHTML = CryptoJS!.enc.Base64
-        .parse($cipherText.textContent!.replace(salt, ''))
-        .toString(CryptoJS!.enc.Utf8)
-      $cipherText.parentElement!.classList.add('decrypted')
+      const cipher = $template.dataset.cipher
+      const payload = $template.innerHTML
+
+      let html: string
+      if (!cipher) {
+        // Dev mode: no post-build encryption, content is plaintext
+        html = payload
+      }
+      else if (cipher === 'aes-256-gcm-v2') {
+        html = await this.#decryptV2(payload, passwordHash)
+      }
+      else {
+        throw new Error(`Unsupported cipher: ${cipher}`)
+      }
+
+      $target.innerHTML = html
+      $template.parentElement!.classList.add('decrypted')
     }
     catch (err) {
+      const $encryptor = $template.parentElement!
+      const $input = $encryptor.querySelector<HTMLInputElement>('.fixit-decryptor-input')
+      if ($input) {
+        flashTooltip($input, err instanceof Error ? err.message : 'Decryption failed')
+      }
       return console.error(err)
     }
     if ($target.id === 'content')
-      eventBus.emit('fixit:decrypted')
+      eventBus.emit('fixit:decrypted', { target: $target })
     else
       eventBus.emit('fixit:partial-decrypted', { target: $target })
   }
 
   /**
    * Validate user input against the stored password hash; invoke callback on success.
+   * Supports both PBKDF2-verified (post-build) and plain SHA-256 (dev mode) passwords.
    * @param $encryptor - The `<fixit-encryptor>` element containing the input field.
-   * @param callback - Invoked with `(cipherText, passwordHash, salt)` on success.
+   * @param callback - Invoked with `(template, sha256Hash)` on success.
    */
-  async #validatePassword($encryptor: Element, callback: ($cipherText: HTMLElement, passwordHash: string, salt: string) => void) {
-    const $cipherText = $encryptor.querySelector<HTMLElement>('cipher-text')!
-    const password = $cipherText.dataset.password
+  async #validatePassword($encryptor: Element, callback: ($template: HTMLTemplateElement, passwordHash: string, verifyHash?: string) => Promise<void>): Promise<void> {
+    const $template = $encryptor.querySelector<HTMLTemplateElement>('template[data-password]')!
+    const storedHash = $template.dataset.password!
+    const verifySalt = $template.dataset.verifySalt
     const inputEl = $encryptor.querySelector<HTMLInputElement>('.fixit-decryptor-input')!
     const input = inputEl.value.trim()
-    const { h64ToString } = await window.xxhash!()
-    const inputHash = h64ToString(input)
-    const inputSha256 = CryptoJS!.SHA256(input).toString()
-    const saltLen = input.length % 2 ? input.length : input.length + 1
+    const inputSha256 = await this.#sha256Hex(input)
 
     inputEl.value = ''
     inputEl.blur()
@@ -79,11 +154,27 @@ class FixItDecryptor {
       flashTooltip(inputEl, 'Please enter the correct password!')
       return console.warn('Please enter the correct password!')
     }
-    if (inputHash !== password) {
+
+    let matches: boolean
+    let verifyHash: string
+    if (verifySalt) {
+      // Post-build: stored hash is PBKDF2(SHA-256(password), verifySalt)
+      const salt = Uint8Array.from(atob(verifySalt), c => c.charCodeAt(0)).buffer as ArrayBuffer
+      verifyHash = await this.#deriveVerifyHash(inputSha256, salt)
+      matches = verifyHash === storedHash
+    }
+    else {
+      // Dev mode: stored hash is SHA-256(password)
+      verifyHash = inputSha256
+      matches = inputSha256 === storedHash
+    }
+
+    if (!matches) {
       flashTooltip(inputEl, `Password error: ${input} not the correct password!`)
       return console.warn(`Password error: ${input} not the correct password!`)
     }
-    callback($cipherText, inputHash, inputSha256.slice(saltLen))
+    // Store verifyHash for cache validation, inputSha256 for AES key derivation
+    await callback($template, inputSha256, verifyHash)
   }
 
   /**
@@ -92,11 +183,10 @@ class FixItDecryptor {
    * @param options.all - Enable whole-page decryption.
    * @param options.shortcode - Enable shortcode-level decryption.
    */
-  init({ all, shortcode }: { all?: boolean, shortcode?: boolean }) {
-    const $content = document.querySelector<HTMLElement>('#content')
+  init({ all, shortcode }: { all?: boolean, shortcode?: boolean }): void {
     if (shortcode) {
-      eventBus.on('fixit:decrypted', () => {
-        this.initShortcodes($content!)
+      eventBus.on('fixit:decrypted', ({ detail }) => {
+        this.initShortcodes(detail.target)
       })
       eventBus.on('fixit:partial-decrypted', ({ detail }) => {
         this.initShortcodes(detail.target)
@@ -106,28 +196,49 @@ class FixItDecryptor {
       this.initPage()
     }
     else if (shortcode) {
-      this.initShortcodes($content!)
+      this.initShortcodes(document.querySelector<HTMLElement>('#content')!)
+    }
+  }
+
+  /**
+   * Decrypt the TOC template content in place.
+   * After decryption, TocModule.initToc() (via fixit:decrypted event) copies it to containers.
+   * @param passwordHash - SHA-256 hash for AES key derivation.
+   */
+  async #restoreToc(passwordHash: string): Promise<void> {
+    const $tocTemplate = document.querySelector<HTMLTemplateElement>('template[data-toc][data-cipher]')
+    if (!$tocTemplate)
+      return
+    try {
+      const cipher = $tocTemplate.dataset.cipher
+      const payload = $tocTemplate.innerHTML
+      if (cipher === 'aes-256-gcm-v2')
+        $tocTemplate.innerHTML = await this.#decryptV2(payload, passwordHash)
+    }
+    catch (err) {
+      console.error('[FixItDecryptor] Failed to restore TOC:', err)
     }
   }
 
   /** Initialize whole-page decryption with cache validation and encrypt/re-encrypt buttons. */
-  initPage() {
+  initPage(): void {
     this.validateCache()
     const $encryptor = document.querySelector<HTMLElement>('article > fixit-encryptor')!
     const $content = document.querySelector<HTMLElement>('#content')!
 
     const decryptorHandler = () => {
-      this.#validatePassword($encryptor, ($cipherText, passwordHash, salt) => {
+      void this.#validatePassword($encryptor, async ($template, passwordHash, verifyHash) => {
         window.localStorage?.setItem(
           `fixit-decryptor/#${location.pathname}`,
           JSON.stringify({
             expiration: Math.ceil(Date.now() / 1000) + this.options.duration,
-            password: passwordHash,
-            salt,
+            password: verifyHash ?? passwordHash,
+            sha256: passwordHash,
           }),
         )
-        this.#decryptContent($cipherText, $content, salt)
-      })
+        await this.#restoreToc(passwordHash)
+        await this.#decryptContent($template, $content, passwordHash)
+      }).catch(console.error)
     }
 
     $encryptor.querySelector('.fixit-decryptor-input')?.addEventListener('keydown', (e) => {
@@ -142,10 +253,29 @@ class FixItDecryptor {
       decryptorHandler()
     })
 
-    $encryptor.querySelector('.fixit-encryptor-btn')?.addEventListener('click', (e) => {
+    // Only for full-page decryption: re-encrypt button to clear cache and reset content
+    const $reEncryptBtn = $encryptor.querySelector<HTMLElement>('.fixit-encryptor-btn')
+    $reEncryptBtn?.addEventListener('click', (e) => {
       e.preventDefault()
+      window.CellTooltip?.getOrCreateInstance($reEncryptBtn).dispose()
+      $content.animate(
+        [
+          { opacity: 1, transform: 'scaleY(1)', transformOrigin: 'top' },
+          { opacity: 0, transform: 'scaleY(0)', transformOrigin: 'top' },
+        ],
+        { duration: 200, easing: 'ease-out' },
+      ).finished.then(() => {
+        $content.textContent = ''
+        $content.style.opacity = ''
+        $content.style.transform = ''
+      })
+      for (const id of ['toc-content-static', 'toc-content-auto', 'toc-content-drawer']) {
+        const $el = document.getElementById(id)
+        if ($el?.querySelector('nav')) {
+          $el.textContent = ''
+        }
+      }
       $encryptor.classList.remove('decrypted')
-      $content.innerHTML = ''
       window.localStorage?.removeItem(`fixit-decryptor/#${location.pathname}`)
       eventBus.emit('fixit:re-encrypt')
     })
@@ -157,15 +287,15 @@ class FixItDecryptor {
    * Initialize decryption for all unprocessed `fixit-encryptor` shortcodes under a parent.
    * @param $parent - The parent element to search for shortcodes.
    */
-  initShortcodes($parent: Element) {
+  initShortcodes($parent: Element): void {
     const $shortcodes = $parent.querySelectorAll<HTMLElement>('fixit-encryptor:not(.initialized)')
 
     $shortcodes.forEach(($shortcode) => {
       const decryptorHandler = () => {
         const $content = $shortcode.querySelector<HTMLElement>('.decryptor-content')!
-        this.#validatePassword($shortcode, ($cipherText, passwordHash, salt) => {
-          this.#decryptContent($cipherText, $content, salt)
-        })
+        void this.#validatePassword($shortcode, async ($template, passwordHash) => {
+          await this.#decryptContent($template, $content, passwordHash)
+        }).catch(console.error)
       }
 
       $shortcode.querySelector('.fixit-decryptor-input')?.addEventListener('keydown', (e) => {
@@ -185,11 +315,11 @@ class FixItDecryptor {
   }
 
   /** Restore decrypted content from localStorage cache if the password has not expired. */
-  validateCache() {
+  validateCache(): this {
     const $content = document.querySelector<HTMLElement>('#content')!
     const $encryptor = document.querySelector<HTMLElement>('article > fixit-encryptor')!
-    const $cipherText = $encryptor.querySelector<HTMLElement>('cipher-text')!
-    const password = $cipherText.dataset.password
+    const $template = $encryptor.querySelector<HTMLTemplateElement>('template[data-password]')!
+    const password = $template.dataset.password
     const cachedStat: CachedStat | null = JSON.parse(window.localStorage?.getItem(`fixit-decryptor/#${location.pathname}`) || 'null')
 
     if (!cachedStat || cachedStat.password !== password || cachedStat.expiration < Math.ceil(Date.now() / 1000)) {
@@ -199,7 +329,9 @@ class FixItDecryptor {
       }
       return this
     }
-    this.#decryptContent($cipherText, $content, cachedStat.salt)
+    // Use sha256 hash for AES key derivation (not the verification hash)
+    void this.#restoreToc(cachedStat.sha256)
+      .then(() => this.#decryptContent($template, $content, cachedStat.sha256))
     return this
   }
 }
diff --git a/assets/js/modules/content.ts b/assets/js/modules/content.ts
index 674f7fe3..5623a3b6 100644
--- a/assets/js/modules/content.ts
+++ b/assets/js/modules/content.ts
@@ -117,7 +117,7 @@ export class ContentModule implements ContentService {
   initDetails(target: Element | Document = document) {
     target.querySelectorAll<HTMLElement>('.details:not(.disabled)').forEach(($details) => {
       const $summary = $details.querySelector<HTMLElement>('.details-summary')!
-      $summary.addEventListener('click', () => {
+      $summary?.addEventListener('click', () => {
         $details.classList.toggle('open')
       }, false)
     })
@@ -166,6 +166,7 @@ export class ContentModule implements ContentService {
     CellTooltip.initAll('li[data-task] > span[title]', { placement: 'right' })
     CellTooltip.initAll('.action-btn[title]', { placement: 'bottom' })
     CellTooltip.initAll('.copy-icon-btn[title]', { placement: 'top' })
+    CellTooltip.initAll('.fixit-encryptor-btn[title]')
     this.#initFootnotes()
   }
 
@@ -186,8 +187,8 @@ export class ContentModule implements ContentService {
   setup() {
     this.initContent()
     this.initSVGIcon()
-    eventBus.on('fixit:decrypted', () => {
-      this.initContent()
+    eventBus.on('fixit:decrypted', ({ detail }) => {
+      this.initContent(detail.target)
     })
     eventBus.on('fixit:partial-decrypted', ({ detail }) => {
       this.initContent(detail.target)
diff --git a/assets/js/modules/encryption.ts b/assets/js/modules/encryption.ts
index b7dc7486..824159ed 100644
--- a/assets/js/modules/encryption.ts
+++ b/assets/js/modules/encryption.ts
@@ -26,7 +26,7 @@ export class EncryptionModule implements EncryptionService {
 
   /** Initialize the FixItDecryptor and wire up decryption/re-encryption events. */
   setup() {
-    if (!this.core.config.encryption)
+    if (!this.core.config.encryption || !window.FixItDecryptor)
       return
     const decryptor = new window.FixItDecryptor()
 
diff --git a/assets/js/modules/events.ts b/assets/js/modules/events.ts
index 6867fb47..7f219827 100644
--- a/assets/js/modules/events.ts
+++ b/assets/js/modules/events.ts
@@ -1,4 +1,4 @@
-import type { CodeService, CoreService, EventsService, TocService } from '../core/tokens'
+import type { CodeService, CoreService, EventsService } from '../core/tokens'
 import { eventBus } from '../core/event-bus'
 import { animateCSS, getScrollTop, isMobile, scrollIntoView } from '../utils'
 
@@ -18,7 +18,6 @@ export class EventsModule implements EventsService {
 
   constructor(
     private readonly core: CoreService,
-    private readonly toc: TocService,
     private readonly code: CodeService,
   ) {}
 
@@ -83,8 +82,6 @@ export class EventsModule implements EventsService {
         }
       }
       eventBus.emit('fixit:scroll')
-      this.toc.syncTocHeight()
-      this.toc.syncTocActiveState()
       this.#oldScrollTop = this.#newScrollTop
     }, false)
   }
@@ -97,9 +94,6 @@ export class EventsModule implements EventsService {
         this.#resizeTimeout = window.setTimeout(() => {
           this.#resizeTimeout = null
           eventBus.emit('fixit:resize')
-          this.toc.initToc()
-          this.toc.syncTocHeight()
-          this.toc.syncTocActiveState()
 
           const _isMobile = isMobile()
           if (_isMobile !== resizeBefore) {
diff --git a/assets/js/modules/toc.ts b/assets/js/modules/toc.ts
index 1ea6dcb8..7e579f6d 100644
--- a/assets/js/modules/toc.ts
+++ b/assets/js/modules/toc.ts
@@ -1,4 +1,5 @@
 import type { TocService } from '../core/tokens'
+import { eventBus } from '../core/event-bus'
 import { animateCSS, isTocStatic } from '../utils'
 
 /**
@@ -70,7 +71,7 @@ export class TocModule implements TocService {
   /** Get all TOC root containers (static, auto, and drawer). */
   getTocRoots(): HTMLElement[] {
     return [
-      document.getElementById('TableOfContents'),
+      document.querySelector<HTMLElement>('#toc-content-auto > nav'),
       document.querySelector<HTMLElement>('#toc-content-static > nav'),
       document.querySelector<HTMLElement>('#toc-content-drawer > nav'),
     ].filter(Boolean) as HTMLElement[]
@@ -160,7 +161,7 @@ export class TocModule implements TocService {
     if (this.activeTocId !== activeId) {
       this.activeTocId = activeId
       if (!isTocStatic()) {
-        const $autoTocRoot = document.getElementById('TableOfContents')
+        const $autoTocRoot = document.querySelector<HTMLElement>('#toc-content-auto > nav')
         const $autoTocContainer = document.getElementById('toc-content-auto')
         if ($autoTocRoot && $autoTocContainer) {
           this.scrollActiveTocLinkIntoView($autoTocRoot, activeId, $autoTocContainer)
@@ -173,42 +174,33 @@ export class TocModule implements TocService {
     }
   }
 
-  /** Initialize TOC layout: move the TOC node to the correct container and sync state. */
-  initToc() {
-    const $tocCore = document.getElementById('TableOfContents')
-    if ($tocCore === null)
-      return
-    // TOC Drawer Button Visibility
-    const openButton = document.querySelector<HTMLElement>('#toc-drawer-button')
-    if (openButton) {
-      openButton.classList.toggle('hidden', !isTocStatic())
-    }
+  /** Sync TOC layout state: drawer button visibility, height, and active heading. */
+  syncTocLayout() {
+    document.querySelector<HTMLElement>('#toc-drawer-button')?.classList.toggle('hidden', !isTocStatic())
     this.activeTocId = null
-    // TOC Static and TOC Dialog
-    if (isTocStatic()) {
-      const $tocContentStatic = document.getElementById('toc-content-static')!
-      if ($tocCore.parentElement !== $tocContentStatic) {
-        $tocCore.parentElement!.removeChild($tocCore)
-        $tocContentStatic.appendChild($tocCore)
-      }
-      this.syncTocHeight()
-      this.syncTocActiveState()
-      return
-    }
-
-    // TOC Auto
-    const $tocContentAuto = document.getElementById('toc-content-auto')!
-    if ($tocCore.parentElement !== $tocContentAuto) {
-      $tocCore.parentElement!.removeChild($tocCore)
-      $tocContentAuto.appendChild($tocCore)
-    }
-    const $toc = document.getElementById('toc-auto')!
-    $toc.style.visibility = 'visible'
-    animateCSS($toc, ['animate__fadeIn', 'animate__faster'], true)
     this.syncTocHeight()
     this.syncTocActiveState()
   }
 
+  /** Initialize TOC layout: read from `<template data-toc>`, copy to the correct container and dialog. */
+  initToc() {
+    const $tocTemplate = document.querySelector<HTMLTemplateElement>('template[data-toc]')
+    const $tocCore = $tocTemplate?.content.querySelector('#TableOfContents')
+    if (!$tocTemplate || !$tocCore)
+      return
+
+    // Copy TOC to target containers
+    const targets = ['toc-content-drawer', 'toc-content-static', 'toc-content-auto']
+    for (const id of targets) {
+      const $container = document.getElementById(id)
+      if ($container && !$container.querySelector('nav')) {
+        const $clone = $tocCore.cloneNode(true) as HTMLElement
+        $clone.removeAttribute('id')
+        $container.appendChild($clone)
+      }
+    }
+  }
+
   /** Bind the TOC title click handler for show/hide toggle. */
   initTocListener() {
     const $toc = document.getElementById('toc-auto')!
@@ -255,15 +247,9 @@ export class TocModule implements TocService {
     })
   }
 
-  /** Clone TOC and heading-mark nodes to detach APlayer event listeners. */
+  /** Clone heading-mark nodes to detach APlayer event listeners. */
   fixTocScroll() {
     if (typeof window.APlayer === 'function') {
-      let $tocCore = document.getElementById('TableOfContents')
-      if ($tocCore) {
-        const $newTocCore = $tocCore.cloneNode(true) as HTMLElement
-        $tocCore.parentElement!.replaceChild($newTocCore, $tocCore)
-        $tocCore = $newTocCore
-      }
       document.querySelectorAll('.heading-mark').forEach(($headingMark: Element) => {
         const $newHeadingMark = $headingMark.cloneNode(true)
         $headingMark.parentElement!.replaceChild($newHeadingMark, $headingMark)
@@ -273,9 +259,16 @@ export class TocModule implements TocService {
 
   /** Initialize all TOC components and register event listeners. */
   setup() {
-    this.fixTocScroll()
     this.initToc()
+    this.syncTocLayout()
     this.initTocListener()
     this.initTocDialog()
+    this.fixTocScroll()
+    eventBus.on('fixit:resize', () => this.syncTocLayout())
+    eventBus.on('fixit:scroll', () => this.syncTocActiveState())
+    eventBus.on('fixit:decrypted', () => {
+      this.initToc()
+      this.syncTocLayout()
+    })
   }
 }
diff --git a/assets/js/types/global.ts b/assets/js/types/global.ts
index 895c24d6..2150e797 100644
--- a/assets/js/types/global.ts
+++ b/assets/js/types/global.ts
@@ -7,6 +7,25 @@ export interface TabContainerChangedDetail {
   relatedTarget?: Element | null
 }
 
+export interface FixItDecryptorOptions {
+  /** Cache duration in seconds for decrypted content (default: 24 hours) */
+  duration?: number
+}
+
+export interface FixItDecryptorInstance {
+  /**
+   * Initialize page-level and/or shortcode-level decryption based on flags.
+   * @param options - `{ all?, shortcode? }` controlling which modes to activate.
+   * @param options.all - Enable whole-page decryption.
+   * @param options.shortcode - Enable shortcode-level decryption.
+   */
+  init: (options: { all?: boolean, shortcode?: boolean }) => void
+  /** Restore decrypted content from localStorage cache if the password has not expired. */
+  validateCache: () => this
+}
+
+export type FixItDecryptorConstructor = new (options?: FixItDecryptorOptions) => FixItDecryptorInstance
+
 export type TabContainerChangedEvent = CustomEvent<TabContainerChangedDetail> & {
   panel: Element | null
 }
@@ -24,7 +43,6 @@ declare global {
     'APlayer'?: any
     'CellTooltip'?: any
     'cookieconsent'?: any
-    'CryptoJS'?: any
     'echarts'?: any
     'Fuse'?: any
     'Gitalk'?: any
@@ -46,7 +64,6 @@ declare global {
     'Valine'?: any
     'Waline'?: any
     'Watermark'?: any
-    'xxhash'?: any
     'Panzoom'?: (element: SVGElement, options?: Record<string, unknown>) => PanzoomInstance
 
     // FixIt theme
@@ -54,6 +71,6 @@ declare global {
     'config': FixItConfig
     'mermaid'?: MermaidRuntimeModule
     '_fuseIndex'?: any
-    'FixItDecryptor'?: any
+    'FixItDecryptor'?: FixItDecryptorConstructor
   }
 }
diff --git a/assets/lib/crypto-js/core.js b/assets/lib/crypto-js/core.js
deleted file mode 100644
index e3a498bc..00000000
--- a/assets/lib/crypto-js/core.js
+++ /dev/null
@@ -1,807 +0,0 @@
-;(function (root, factory) {
-	if (typeof exports === "object") {
-		// CommonJS
-		module.exports = exports = factory();
-	}
-	else if (typeof define === "function" && define.amd) {
-		// AMD
-		define([], factory);
-	}
-	else {
-		// Global (browser)
-		root.CryptoJS = factory();
-	}
-}(this, function () {
-
-	/*globals window, global, require*/
-
-	/**
-	 * CryptoJS core components.
-	 */
-	var CryptoJS = CryptoJS || (function (Math, undefined) {
-
-	    var crypto;
-
-	    // Native crypto from window (Browser)
-	    if (typeof window !== 'undefined' && window.crypto) {
-	        crypto = window.crypto;
-	    }
-
-	    // Native crypto in web worker (Browser)
-	    if (typeof self !== 'undefined' && self.crypto) {
-	        crypto = self.crypto;
-	    }
-
-	    // Native crypto from worker
-	    if (typeof globalThis !== 'undefined' && globalThis.crypto) {
-	        crypto = globalThis.crypto;
-	    }
-
-	    // Native (experimental IE 11) crypto from window (Browser)
-	    if (!crypto && typeof window !== 'undefined' && window.msCrypto) {
-	        crypto = window.msCrypto;
-	    }
-
-	    // Native crypto from global (NodeJS)
-	    if (!crypto && typeof global !== 'undefined' && global.crypto) {
-	        crypto = global.crypto;
-	    }
-
-	    // Native crypto import via require (NodeJS)
-	    if (!crypto && typeof require === 'function') {
-	        try {
-	            crypto = require('crypto');
-	        } catch (err) {}
-	    }
-
-	    /*
-	     * Cryptographically secure pseudorandom number generator
-	     *
-	     * As Math.random() is cryptographically not safe to use
-	     */
-	    var cryptoSecureRandomInt = function () {
-	        if (crypto) {
-	            // Use getRandomValues method (Browser)
-	            if (typeof crypto.getRandomValues === 'function') {
-	                try {
-	                    return crypto.getRandomValues(new Uint32Array(1))[0];
-	                } catch (err) {}
-	            }
-
-	            // Use randomBytes method (NodeJS)
-	            if (typeof crypto.randomBytes === 'function') {
-	                try {
-	                    return crypto.randomBytes(4).readInt32LE();
-	                } catch (err) {}
-	            }
-	        }
-
-	        throw new Error('Native crypto module could not be used to get secure random number.');
-	    };
-
-	    /*
-	     * Local polyfill of Object.create
-
-	     */
-	    var create = Object.create || (function () {
-	        function F() {}
-
-	        return function (obj) {
-	            var subtype;
-
-	            F.prototype = obj;
-
-	            subtype = new F();
-
-	            F.prototype = null;
-
-	            return subtype;
-	        };
-	    }());
-
-	    /**
-	     * CryptoJS namespace.
-	     */
-	    var C = {};
-
-	    /**
-	     * Library namespace.
-	     */
-	    var C_lib = C.lib = {};
-
-	    /**
-	     * Base object for prototypal inheritance.
-	     */
-	    var Base = C_lib.Base = (function () {
-
-
-	        return {
-	            /**
-	             * Creates a new object that inherits from this object.
-	             *
-	             * @param {Object} overrides Properties to copy into the new object.
-	             *
-	             * @return {Object} The new object.
-	             *
-	             * @static
-	             *
-	             * @example
-	             *
-	             *     var MyType = CryptoJS.lib.Base.extend({
-	             *         field: 'value',
-	             *
-	             *         method: function () {
-	             *         }
-	             *     });
-	             */
-	            extend: function (overrides) {
-	                // Spawn
-	                var subtype = create(this);
-
-	                // Augment
-	                if (overrides) {
-	                    subtype.mixIn(overrides);
-	                }
-
-	                // Create default initializer
-	                if (!subtype.hasOwnProperty('init') || this.init === subtype.init) {
-	                    subtype.init = function () {
-	                        subtype.$super.init.apply(this, arguments);
-	                    };
-	                }
-
-	                // Initializer's prototype is the subtype object
-	                subtype.init.prototype = subtype;
-
-	                // Reference supertype
-	                subtype.$super = this;
-
-	                return subtype;
-	            },
-
-	            /**
-	             * Extends this object and runs the init method.
-	             * Arguments to create() will be passed to init().
-	             *
-	             * @return {Object} The new object.
-	             *
-	             * @static
-	             *
-	             * @example
-	             *
-	             *     var instance = MyType.create();
-	             */
-	            create: function () {
-	                var instance = this.extend();
-	                instance.init.apply(instance, arguments);
-
-	                return instance;
-	            },
-
-	            /**
-	             * Initializes a newly created object.
-	             * Override this method to add some logic when your objects are created.
-	             *
-	             * @example
-	             *
-	             *     var MyType = CryptoJS.lib.Base.extend({
-	             *         init: function () {
-	             *             // ...
-	             *         }
-	             *     });
-	             */
-	            init: function () {
-	            },
-
-	            /**
-	             * Copies properties into this object.
-	             *
-	             * @param {Object} properties The properties to mix in.
-	             *
-	             * @example
-	             *
-	             *     MyType.mixIn({
-	             *         field: 'value'
-	             *     });
-	             */
-	            mixIn: function (properties) {
-	                for (var propertyName in properties) {
-	                    if (properties.hasOwnProperty(propertyName)) {
-	                        this[propertyName] = properties[propertyName];
-	                    }
-	                }
-
-	                // IE won't copy toString using the loop above
-	                if (properties.hasOwnProperty('toString')) {
-	                    this.toString = properties.toString;
-	                }
-	            },
-
-	            /**
-	             * Creates a copy of this object.
-	             *
-	             * @return {Object} The clone.
-	             *
-	             * @example
-	             *
-	             *     var clone = instance.clone();
-	             */
-	            clone: function () {
-	                return this.init.prototype.extend(this);
-	            }
-	        };
-	    }());
-
-	    /**
-	     * An array of 32-bit words.
-	     *
-	     * @property {Array} words The array of 32-bit words.
-	     * @property {number} sigBytes The number of significant bytes in this word array.
-	     */
-	    var WordArray = C_lib.WordArray = Base.extend({
-	        /**
-	         * Initializes a newly created word array.
-	         *
-	         * @param {Array} words (Optional) An array of 32-bit words.
-	         * @param {number} sigBytes (Optional) The number of significant bytes in the words.
-	         *
-	         * @example
-	         *
-	         *     var wordArray = CryptoJS.lib.WordArray.create();
-	         *     var wordArray = CryptoJS.lib.WordArray.create([0x00010203, 0x04050607]);
-	         *     var wordArray = CryptoJS.lib.WordArray.create([0x00010203, 0x04050607], 6);
-	         */
-	        init: function (words, sigBytes) {
-	            words = this.words = words || [];
-
-	            if (sigBytes != undefined) {
-	                this.sigBytes = sigBytes;
-	            } else {
-	                this.sigBytes = words.length * 4;
-	            }
-	        },
-
-	        /**
-	         * Converts this word array to a string.
-	         *
-	         * @param {Encoder} encoder (Optional) The encoding strategy to use. Default: CryptoJS.enc.Hex
-	         *
-	         * @return {string} The stringified word array.
-	         *
-	         * @example
-	         *
-	         *     var string = wordArray + '';
-	         *     var string = wordArray.toString();
-	         *     var string = wordArray.toString(CryptoJS.enc.Utf8);
-	         */
-	        toString: function (encoder) {
-	            return (encoder || Hex).stringify(this);
-	        },
-
-	        /**
-	         * Concatenates a word array to this word array.
-	         *
-	         * @param {WordArray} wordArray The word array to append.
-	         *
-	         * @return {WordArray} This word array.
-	         *
-	         * @example
-	         *
-	         *     wordArray1.concat(wordArray2);
-	         */
-	        concat: function (wordArray) {
-	            // Shortcuts
-	            var thisWords = this.words;
-	            var thatWords = wordArray.words;
-	            var thisSigBytes = this.sigBytes;
-	            var thatSigBytes = wordArray.sigBytes;
-
-	            // Clamp excess bits
-	            this.clamp();
-
-	            // Concat
-	            if (thisSigBytes % 4) {
-	                // Copy one byte at a time
-	                for (var i = 0; i < thatSigBytes; i++) {
-	                    var thatByte = (thatWords[i >>> 2] >>> (24 - (i % 4) * 8)) & 0xff;
-	                    thisWords[(thisSigBytes + i) >>> 2] |= thatByte << (24 - ((thisSigBytes + i) % 4) * 8);
-	                }
-	            } else {
-	                // Copy one word at a time
-	                for (var j = 0; j < thatSigBytes; j += 4) {
-	                    thisWords[(thisSigBytes + j) >>> 2] = thatWords[j >>> 2];
-	                }
-	            }
-	            this.sigBytes += thatSigBytes;
-
-	            // Chainable
-	            return this;
-	        },
-
-	        /**
-	         * Removes insignificant bits.
-	         *
-	         * @example
-	         *
-	         *     wordArray.clamp();
-	         */
-	        clamp: function () {
-	            // Shortcuts
-	            var words = this.words;
-	            var sigBytes = this.sigBytes;
-
-	            // Clamp
-	            words[sigBytes >>> 2] &= 0xffffffff << (32 - (sigBytes % 4) * 8);
-	            words.length = Math.ceil(sigBytes / 4);
-	        },
-
-	        /**
-	         * Creates a copy of this word array.
-	         *
-	         * @return {WordArray} The clone.
-	         *
-	         * @example
-	         *
-	         *     var clone = wordArray.clone();
-	         */
-	        clone: function () {
-	            var clone = Base.clone.call(this);
-	            clone.words = this.words.slice(0);
-
-	            return clone;
-	        },
-
-	        /**
-	         * Creates a word array filled with random bytes.
-	         *
-	         * @param {number} nBytes The number of random bytes to generate.
-	         *
-	         * @return {WordArray} The random word array.
-	         *
-	         * @static
-	         *
-	         * @example
-	         *
-	         *     var wordArray = CryptoJS.lib.WordArray.random(16);
-	         */
-	        random: function (nBytes) {
-	            var words = [];
-
-	            for (var i = 0; i < nBytes; i += 4) {
-	                words.push(cryptoSecureRandomInt());
-	            }
-
-	            return new WordArray.init(words, nBytes);
-	        }
-	    });
-
-	    /**
-	     * Encoder namespace.
-	     */
-	    var C_enc = C.enc = {};
-
-	    /**
-	     * Hex encoding strategy.
-	     */
-	    var Hex = C_enc.Hex = {
-	        /**
-	         * Converts a word array to a hex string.
-	         *
-	         * @param {WordArray} wordArray The word array.
-	         *
-	         * @return {string} The hex string.
-	         *
-	         * @static
-	         *
-	         * @example
-	         *
-	         *     var hexString = CryptoJS.enc.Hex.stringify(wordArray);
-	         */
-	        stringify: function (wordArray) {
-	            // Shortcuts
-	            var words = wordArray.words;
-	            var sigBytes = wordArray.sigBytes;
-
-	            // Convert
-	            var hexChars = [];
-	            for (var i = 0; i < sigBytes; i++) {
-	                var bite = (words[i >>> 2] >>> (24 - (i % 4) * 8)) & 0xff;
-	                hexChars.push((bite >>> 4).toString(16));
-	                hexChars.push((bite & 0x0f).toString(16));
-	            }
-
-	            return hexChars.join('');
-	        },
-
-	        /**
-	         * Converts a hex string to a word array.
-	         *
-	         * @param {string} hexStr The hex string.
-	         *
-	         * @return {WordArray} The word array.
-	         *
-	         * @static
-	         *
-	         * @example
-	         *
-	         *     var wordArray = CryptoJS.enc.Hex.parse(hexString);
-	         */
-	        parse: function (hexStr) {
-	            // Shortcut
-	            var hexStrLength = hexStr.length;
-
-	            // Convert
-	            var words = [];
-	            for (var i = 0; i < hexStrLength; i += 2) {
-	                words[i >>> 3] |= parseInt(hexStr.substr(i, 2), 16) << (24 - (i % 8) * 4);
-	            }
-
-	            return new WordArray.init(words, hexStrLength / 2);
-	        }
-	    };
-
-	    /**
-	     * Latin1 encoding strategy.
-	     */
-	    var Latin1 = C_enc.Latin1 = {
-	        /**
-	         * Converts a word array to a Latin1 string.
-	         *
-	         * @param {WordArray} wordArray The word array.
-	         *
-	         * @return {string} The Latin1 string.
-	         *
-	         * @static
-	         *
-	         * @example
-	         *
-	         *     var latin1String = CryptoJS.enc.Latin1.stringify(wordArray);
-	         */
-	        stringify: function (wordArray) {
-	            // Shortcuts
-	            var words = wordArray.words;
-	            var sigBytes = wordArray.sigBytes;
-
-	            // Convert
-	            var latin1Chars = [];
-	            for (var i = 0; i < sigBytes; i++) {
-	                var bite = (words[i >>> 2] >>> (24 - (i % 4) * 8)) & 0xff;
-	                latin1Chars.push(String.fromCharCode(bite));
-	            }
-
-	            return latin1Chars.join('');
-	        },
-
-	        /**
-	         * Converts a Latin1 string to a word array.
-	         *
-	         * @param {string} latin1Str The Latin1 string.
-	         *
-	         * @return {WordArray} The word array.
-	         *
-	         * @static
-	         *
-	         * @example
-	         *
-	         *     var wordArray = CryptoJS.enc.Latin1.parse(latin1String);
-	         */
-	        parse: function (latin1Str) {
-	            // Shortcut
-	            var latin1StrLength = latin1Str.length;
-
-	            // Convert
-	            var words = [];
-	            for (var i = 0; i < latin1StrLength; i++) {
-	                words[i >>> 2] |= (latin1Str.charCodeAt(i) & 0xff) << (24 - (i % 4) * 8);
-	            }
-
-	            return new WordArray.init(words, latin1StrLength);
-	        }
-	    };
-
-	    /**
-	     * UTF-8 encoding strategy.
-	     */
-	    var Utf8 = C_enc.Utf8 = {
-	        /**
-	         * Converts a word array to a UTF-8 string.
-	         *
-	         * @param {WordArray} wordArray The word array.
-	         *
-	         * @return {string} The UTF-8 string.
-	         *
-	         * @static
-	         *
-	         * @example
-	         *
-	         *     var utf8String = CryptoJS.enc.Utf8.stringify(wordArray);
-	         */
-	        stringify: function (wordArray) {
-	            try {
-	                return decodeURIComponent(escape(Latin1.stringify(wordArray)));
-	            } catch (e) {
-	                throw new Error('Malformed UTF-8 data');
-	            }
-	        },
-
-	        /**
-	         * Converts a UTF-8 string to a word array.
-	         *
-	         * @param {string} utf8Str The UTF-8 string.
-	         *
-	         * @return {WordArray} The word array.
-	         *
-	         * @static
-	         *
-	         * @example
-	         *
-	         *     var wordArray = CryptoJS.enc.Utf8.parse(utf8String);
-	         */
-	        parse: function (utf8Str) {
-	            return Latin1.parse(unescape(encodeURIComponent(utf8Str)));
-	        }
-	    };
-
-	    /**
-	     * Abstract buffered block algorithm template.
-	     *
-	     * The property blockSize must be implemented in a concrete subtype.
-	     *
-	     * @property {number} _minBufferSize The number of blocks that should be kept unprocessed in the buffer. Default: 0
-	     */
-	    var BufferedBlockAlgorithm = C_lib.BufferedBlockAlgorithm = Base.extend({
-	        /**
-	         * Resets this block algorithm's data buffer to its initial state.
-	         *
-	         * @example
-	         *
-	         *     bufferedBlockAlgorithm.reset();
-	         */
-	        reset: function () {
-	            // Initial values
-	            this._data = new WordArray.init();
-	            this._nDataBytes = 0;
-	        },
-
-	        /**
-	         * Adds new data to this block algorithm's buffer.
-	         *
-	         * @param {WordArray|string} data The data to append. Strings are converted to a WordArray using UTF-8.
-	         *
-	         * @example
-	         *
-	         *     bufferedBlockAlgorithm._append('data');
-	         *     bufferedBlockAlgorithm._append(wordArray);
-	         */
-	        _append: function (data) {
-	            // Convert string to WordArray, else assume WordArray already
-	            if (typeof data == 'string') {
-	                data = Utf8.parse(data);
-	            }
-
-	            // Append
-	            this._data.concat(data);
-	            this._nDataBytes += data.sigBytes;
-	        },
-
-	        /**
-	         * Processes available data blocks.
-	         *
-	         * This method invokes _doProcessBlock(offset), which must be implemented by a concrete subtype.
-	         *
-	         * @param {boolean} doFlush Whether all blocks and partial blocks should be processed.
-	         *
-	         * @return {WordArray} The processed data.
-	         *
-	         * @example
-	         *
-	         *     var processedData = bufferedBlockAlgorithm._process();
-	         *     var processedData = bufferedBlockAlgorithm._process(!!'flush');
-	         */
-	        _process: function (doFlush) {
-	            var processedWords;
-
-	            // Shortcuts
-	            var data = this._data;
-	            var dataWords = data.words;
-	            var dataSigBytes = data.sigBytes;
-	            var blockSize = this.blockSize;
-	            var blockSizeBytes = blockSize * 4;
-
-	            // Count blocks ready
-	            var nBlocksReady = dataSigBytes / blockSizeBytes;
-	            if (doFlush) {
-	                // Round up to include partial blocks
-	                nBlocksReady = Math.ceil(nBlocksReady);
-	            } else {
-	                // Round down to include only full blocks,
-	                // less the number of blocks that must remain in the buffer
-	                nBlocksReady = Math.max((nBlocksReady | 0) - this._minBufferSize, 0);
-	            }
-
-	            // Count words ready
-	            var nWordsReady = nBlocksReady * blockSize;
-
-	            // Count bytes ready
-	            var nBytesReady = Math.min(nWordsReady * 4, dataSigBytes);
-
-	            // Process blocks
-	            if (nWordsReady) {
-	                for (var offset = 0; offset < nWordsReady; offset += blockSize) {
-	                    // Perform concrete-algorithm logic
-	                    this._doProcessBlock(dataWords, offset);
-	                }
-
-	                // Remove processed words
-	                processedWords = dataWords.splice(0, nWordsReady);
-	                data.sigBytes -= nBytesReady;
-	            }
-
-	            // Return processed words
-	            return new WordArray.init(processedWords, nBytesReady);
-	        },
-
-	        /**
-	         * Creates a copy of this object.
-	         *
-	         * @return {Object} The clone.
-	         *
-	         * @example
-	         *
-	         *     var clone = bufferedBlockAlgorithm.clone();
-	         */
-	        clone: function () {
-	            var clone = Base.clone.call(this);
-	            clone._data = this._data.clone();
-
-	            return clone;
-	        },
-
-	        _minBufferSize: 0
-	    });
-
-	    /**
-	     * Abstract hasher template.
-	     *
-	     * @property {number} blockSize The number of 32-bit words this hasher operates on. Default: 16 (512 bits)
-	     */
-	    var Hasher = C_lib.Hasher = BufferedBlockAlgorithm.extend({
-	        /**
-	         * Configuration options.
-	         */
-	        cfg: Base.extend(),
-
-	        /**
-	         * Initializes a newly created hasher.
-	         *
-	         * @param {Object} cfg (Optional) The configuration options to use for this hash computation.
-	         *
-	         * @example
-	         *
-	         *     var hasher = CryptoJS.algo.SHA256.create();
-	         */
-	        init: function (cfg) {
-	            // Apply config defaults
-	            this.cfg = this.cfg.extend(cfg);
-
-	            // Set initial values
-	            this.reset();
-	        },
-
-	        /**
-	         * Resets this hasher to its initial state.
-	         *
-	         * @example
-	         *
-	         *     hasher.reset();
-	         */
-	        reset: function () {
-	            // Reset data buffer
-	            BufferedBlockAlgorithm.reset.call(this);
-
-	            // Perform concrete-hasher logic
-	            this._doReset();
-	        },
-
-	        /**
-	         * Updates this hasher with a message.
-	         *
-	         * @param {WordArray|string} messageUpdate The message to append.
-	         *
-	         * @return {Hasher} This hasher.
-	         *
-	         * @example
-	         *
-	         *     hasher.update('message');
-	         *     hasher.update(wordArray);
-	         */
-	        update: function (messageUpdate) {
-	            // Append
-	            this._append(messageUpdate);
-
-	            // Update the hash
-	            this._process();
-
-	            // Chainable
-	            return this;
-	        },
-
-	        /**
-	         * Finalizes the hash computation.
-	         * Note that the finalize operation is effectively a destructive, read-once operation.
-	         *
-	         * @param {WordArray|string} messageUpdate (Optional) A final message update.
-	         *
-	         * @return {WordArray} The hash.
-	         *
-	         * @example
-	         *
-	         *     var hash = hasher.finalize();
-	         *     var hash = hasher.finalize('message');
-	         *     var hash = hasher.finalize(wordArray);
-	         */
-	        finalize: function (messageUpdate) {
-	            // Final message update
-	            if (messageUpdate) {
-	                this._append(messageUpdate);
-	            }
-
-	            // Perform concrete-hasher logic
-	            var hash = this._doFinalize();
-
-	            return hash;
-	        },
-
-	        blockSize: 512/32,
-
-	        /**
-	         * Creates a shortcut function to a hasher's object interface.
-	         *
-	         * @param {Hasher} hasher The hasher to create a helper for.
-	         *
-	         * @return {Function} The shortcut function.
-	         *
-	         * @static
-	         *
-	         * @example
-	         *
-	         *     var SHA256 = CryptoJS.lib.Hasher._createHelper(CryptoJS.algo.SHA256);
-	         */
-	        _createHelper: function (hasher) {
-	            return function (message, cfg) {
-	                return new hasher.init(cfg).finalize(message);
-	            };
-	        },
-
-	        /**
-	         * Creates a shortcut function to the HMAC's object interface.
-	         *
-	         * @param {Hasher} hasher The hasher to use in this HMAC helper.
-	         *
-	         * @return {Function} The shortcut function.
-	         *
-	         * @static
-	         *
-	         * @example
-	         *
-	         *     var HmacSHA256 = CryptoJS.lib.Hasher._createHmacHelper(CryptoJS.algo.SHA256);
-	         */
-	        _createHmacHelper: function (hasher) {
-	            return function (message, key) {
-	                return new C_algo.HMAC.init(hasher, key).finalize(message);
-	            };
-	        }
-	    });
-
-	    /**
-	     * Algorithm namespace.
-	     */
-	    var C_algo = C.algo = {};
-
-	    return C;
-	}(Math));
-
-
-	return CryptoJS;
-
-}));
\ No newline at end of file
diff --git a/assets/lib/crypto-js/enc-base64.js b/assets/lib/crypto-js/enc-base64.js
deleted file mode 100644
index 0ffcd53c..00000000
--- a/assets/lib/crypto-js/enc-base64.js
+++ /dev/null
@@ -1,136 +0,0 @@
-;(function (root, factory) {
-	if (typeof exports === "object") {
-		// CommonJS
-		module.exports = exports = factory(require("./core"));
-	}
-	else if (typeof define === "function" && define.amd) {
-		// AMD
-		define(["./core"], factory);
-	}
-	else {
-		// Global (browser)
-		factory(root.CryptoJS);
-	}
-}(this, function (CryptoJS) {
-
-	(function () {
-	    // Shortcuts
-	    var C = CryptoJS;
-	    var C_lib = C.lib;
-	    var WordArray = C_lib.WordArray;
-	    var C_enc = C.enc;
-
-	    /**
-	     * Base64 encoding strategy.
-	     */
-	    var Base64 = C_enc.Base64 = {
-	        /**
-	         * Converts a word array to a Base64 string.
-	         *
-	         * @param {WordArray} wordArray The word array.
-	         *
-	         * @return {string} The Base64 string.
-	         *
-	         * @static
-	         *
-	         * @example
-	         *
-	         *     var base64String = CryptoJS.enc.Base64.stringify(wordArray);
-	         */
-	        stringify: function (wordArray) {
-	            // Shortcuts
-	            var words = wordArray.words;
-	            var sigBytes = wordArray.sigBytes;
-	            var map = this._map;
-
-	            // Clamp excess bits
-	            wordArray.clamp();
-
-	            // Convert
-	            var base64Chars = [];
-	            for (var i = 0; i < sigBytes; i += 3) {
-	                var byte1 = (words[i >>> 2]       >>> (24 - (i % 4) * 8))       & 0xff;
-	                var byte2 = (words[(i + 1) >>> 2] >>> (24 - ((i + 1) % 4) * 8)) & 0xff;
-	                var byte3 = (words[(i + 2) >>> 2] >>> (24 - ((i + 2) % 4) * 8)) & 0xff;
-
-	                var triplet = (byte1 << 16) | (byte2 << 8) | byte3;
-
-	                for (var j = 0; (j < 4) && (i + j * 0.75 < sigBytes); j++) {
-	                    base64Chars.push(map.charAt((triplet >>> (6 * (3 - j))) & 0x3f));
-	                }
-	            }
-
-	            // Add padding
-	            var paddingChar = map.charAt(64);
-	            if (paddingChar) {
-	                while (base64Chars.length % 4) {
-	                    base64Chars.push(paddingChar);
-	                }
-	            }
-
-	            return base64Chars.join('');
-	        },
-
-	        /**
-	         * Converts a Base64 string to a word array.
-	         *
-	         * @param {string} base64Str The Base64 string.
-	         *
-	         * @return {WordArray} The word array.
-	         *
-	         * @static
-	         *
-	         * @example
-	         *
-	         *     var wordArray = CryptoJS.enc.Base64.parse(base64String);
-	         */
-	        parse: function (base64Str) {
-	            // Shortcuts
-	            var base64StrLength = base64Str.length;
-	            var map = this._map;
-	            var reverseMap = this._reverseMap;
-
-	            if (!reverseMap) {
-	                    reverseMap = this._reverseMap = [];
-	                    for (var j = 0; j < map.length; j++) {
-	                        reverseMap[map.charCodeAt(j)] = j;
-	                    }
-	            }
-
-	            // Ignore padding
-	            var paddingChar = map.charAt(64);
-	            if (paddingChar) {
-	                var paddingIndex = base64Str.indexOf(paddingChar);
-	                if (paddingIndex !== -1) {
-	                    base64StrLength = paddingIndex;
-	                }
-	            }
-
-	            // Convert
-	            return parseLoop(base64Str, base64StrLength, reverseMap);
-
-	        },
-
-	        _map: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='
-	    };
-
-	    function parseLoop(base64Str, base64StrLength, reverseMap) {
-	      var words = [];
-	      var nBytes = 0;
-	      for (var i = 0; i < base64StrLength; i++) {
-	          if (i % 4) {
-	              var bits1 = reverseMap[base64Str.charCodeAt(i - 1)] << ((i % 4) * 2);
-	              var bits2 = reverseMap[base64Str.charCodeAt(i)] >>> (6 - (i % 4) * 2);
-	              var bitsCombined = bits1 | bits2;
-	              words[nBytes >>> 2] |= bitsCombined << (24 - (nBytes % 4) * 8);
-	              nBytes++;
-	          }
-	      }
-	      return WordArray.create(words, nBytes);
-	    }
-	}());
-
-
-	return CryptoJS.enc.Base64;
-
-}));
\ No newline at end of file
diff --git a/assets/lib/crypto-js/sha256.js b/assets/lib/crypto-js/sha256.js
deleted file mode 100644
index de2d7fca..00000000
--- a/assets/lib/crypto-js/sha256.js
+++ /dev/null
@@ -1,199 +0,0 @@
-;(function (root, factory) {
-	if (typeof exports === "object") {
-		// CommonJS
-		module.exports = exports = factory(require("./core"));
-	}
-	else if (typeof define === "function" && define.amd) {
-		// AMD
-		define(["./core"], factory);
-	}
-	else {
-		// Global (browser)
-		factory(root.CryptoJS);
-	}
-}(this, function (CryptoJS) {
-
-	(function (Math) {
-	    // Shortcuts
-	    var C = CryptoJS;
-	    var C_lib = C.lib;
-	    var WordArray = C_lib.WordArray;
-	    var Hasher = C_lib.Hasher;
-	    var C_algo = C.algo;
-
-	    // Initialization and round constants tables
-	    var H = [];
-	    var K = [];
-
-	    // Compute constants
-	    (function () {
-	        function isPrime(n) {
-	            var sqrtN = Math.sqrt(n);
-	            for (var factor = 2; factor <= sqrtN; factor++) {
-	                if (!(n % factor)) {
-	                    return false;
-	                }
-	            }
-
-	            return true;
-	        }
-
-	        function getFractionalBits(n) {
-	            return ((n - (n | 0)) * 0x100000000) | 0;
-	        }
-
-	        var n = 2;
-	        var nPrime = 0;
-	        while (nPrime < 64) {
-	            if (isPrime(n)) {
-	                if (nPrime < 8) {
-	                    H[nPrime] = getFractionalBits(Math.pow(n, 1 / 2));
-	                }
-	                K[nPrime] = getFractionalBits(Math.pow(n, 1 / 3));
-
-	                nPrime++;
-	            }
-
-	            n++;
-	        }
-	    }());
-
-	    // Reusable object
-	    var W = [];
-
-	    /**
-	     * SHA-256 hash algorithm.
-	     */
-	    var SHA256 = C_algo.SHA256 = Hasher.extend({
-	        _doReset: function () {
-	            this._hash = new WordArray.init(H.slice(0));
-	        },
-
-	        _doProcessBlock: function (M, offset) {
-	            // Shortcut
-	            var H = this._hash.words;
-
-	            // Working variables
-	            var a = H[0];
-	            var b = H[1];
-	            var c = H[2];
-	            var d = H[3];
-	            var e = H[4];
-	            var f = H[5];
-	            var g = H[6];
-	            var h = H[7];
-
-	            // Computation
-	            for (var i = 0; i < 64; i++) {
-	                if (i < 16) {
-	                    W[i] = M[offset + i] | 0;
-	                } else {
-	                    var gamma0x = W[i - 15];
-	                    var gamma0  = ((gamma0x << 25) | (gamma0x >>> 7))  ^
-	                                  ((gamma0x << 14) | (gamma0x >>> 18)) ^
-	                                   (gamma0x >>> 3);
-
-	                    var gamma1x = W[i - 2];
-	                    var gamma1  = ((gamma1x << 15) | (gamma1x >>> 17)) ^
-	                                  ((gamma1x << 13) | (gamma1x >>> 19)) ^
-	                                   (gamma1x >>> 10);
-
-	                    W[i] = gamma0 + W[i - 7] + gamma1 + W[i - 16];
-	                }
-
-	                var ch  = (e & f) ^ (~e & g);
-	                var maj = (a & b) ^ (a & c) ^ (b & c);
-
-	                var sigma0 = ((a << 30) | (a >>> 2)) ^ ((a << 19) | (a >>> 13)) ^ ((a << 10) | (a >>> 22));
-	                var sigma1 = ((e << 26) | (e >>> 6)) ^ ((e << 21) | (e >>> 11)) ^ ((e << 7)  | (e >>> 25));
-
-	                var t1 = h + sigma1 + ch + K[i] + W[i];
-	                var t2 = sigma0 + maj;
-
-	                h = g;
-	                g = f;
-	                f = e;
-	                e = (d + t1) | 0;
-	                d = c;
-	                c = b;
-	                b = a;
-	                a = (t1 + t2) | 0;
-	            }
-
-	            // Intermediate hash value
-	            H[0] = (H[0] + a) | 0;
-	            H[1] = (H[1] + b) | 0;
-	            H[2] = (H[2] + c) | 0;
-	            H[3] = (H[3] + d) | 0;
-	            H[4] = (H[4] + e) | 0;
-	            H[5] = (H[5] + f) | 0;
-	            H[6] = (H[6] + g) | 0;
-	            H[7] = (H[7] + h) | 0;
-	        },
-
-	        _doFinalize: function () {
-	            // Shortcuts
-	            var data = this._data;
-	            var dataWords = data.words;
-
-	            var nBitsTotal = this._nDataBytes * 8;
-	            var nBitsLeft = data.sigBytes * 8;
-
-	            // Add padding
-	            dataWords[nBitsLeft >>> 5] |= 0x80 << (24 - nBitsLeft % 32);
-	            dataWords[(((nBitsLeft + 64) >>> 9) << 4) + 14] = Math.floor(nBitsTotal / 0x100000000);
-	            dataWords[(((nBitsLeft + 64) >>> 9) << 4) + 15] = nBitsTotal;
-	            data.sigBytes = dataWords.length * 4;
-
-	            // Hash final blocks
-	            this._process();
-
-	            // Return final computed hash
-	            return this._hash;
-	        },
-
-	        clone: function () {
-	            var clone = Hasher.clone.call(this);
-	            clone._hash = this._hash.clone();
-
-	            return clone;
-	        }
-	    });
-
-	    /**
-	     * Shortcut function to the hasher's object interface.
-	     *
-	     * @param {WordArray|string} message The message to hash.
-	     *
-	     * @return {WordArray} The hash.
-	     *
-	     * @static
-	     *
-	     * @example
-	     *
-	     *     var hash = CryptoJS.SHA256('message');
-	     *     var hash = CryptoJS.SHA256(wordArray);
-	     */
-	    C.SHA256 = Hasher._createHelper(SHA256);
-
-	    /**
-	     * Shortcut function to the HMAC's object interface.
-	     *
-	     * @param {WordArray|string} message The message to hash.
-	     * @param {WordArray|string} key The secret key.
-	     *
-	     * @return {WordArray} The HMAC.
-	     *
-	     * @static
-	     *
-	     * @example
-	     *
-	     *     var hmac = CryptoJS.HmacSHA256(message, key);
-	     */
-	    C.HmacSHA256 = Hasher._createHmacHelper(SHA256);
-	}(Math));
-
-
-	return CryptoJS.SHA256;
-
-}));
\ No newline at end of file
diff --git a/assets/lib/xxhash-wasm/xxhash-wasm.js b/assets/lib/xxhash-wasm/xxhash-wasm.js
deleted file mode 100644
index 8fc56059..00000000
--- a/assets/lib/xxhash-wasm/xxhash-wasm.js
+++ /dev/null
@@ -1 +0,0 @@
-var t,e;t=this,e=function(){"use strict";const t=new Uint8Array([0,97,115,109,1,0,0,0,1,48,8,96,3,127,127,127,1,127,96,3,127,127,127,0,96,2,127,127,0,96,1,127,1,127,96,3,127,127,126,1,126,96,3,126,127,127,1,126,96,2,127,126,0,96,1,127,1,126,3,11,10,0,0,2,1,3,4,5,6,1,7,5,3,1,0,1,7,85,9,3,109,101,109,2,0,5,120,120,104,51,50,0,0,6,105,110,105,116,51,50,0,2,8,117,112,100,97,116,101,51,50,0,3,8,100,105,103,101,115,116,51,50,0,4,5,120,120,104,54,52,0,5,6,105,110,105,116,54,52,0,7,8,117,112,100,97,116,101,54,52,0,8,8,100,105,103,101,115,116,54,52,0,9,10,251,22,10,242,1,1,4,127,32,0,32,1,106,33,3,32,1,65,16,79,4,127,32,3,65,16,107,33,6,32,2,65,168,136,141,161,2,106,33,3,32,2,65,137,235,208,208,7,107,33,4,32,2,65,207,140,162,142,6,106,33,5,3,64,32,3,32,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,3,32,4,32,0,65,4,106,34,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,4,32,2,32,0,65,4,106,34,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,2,32,5,32,0,65,4,106,34,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,5,32,6,32,0,65,4,106,34,0,79,13,0,11,32,2,65,12,119,32,5,65,18,119,106,32,4,65,7,119,106,32,3,65,1,119,106,5,32,2,65,177,207,217,178,1,106,11,32,1,106,32,0,32,1,65,15,113,16,1,11,146,1,0,32,1,32,2,106,33,2,3,64,32,1,65,4,106,32,2,75,69,4,64,32,0,32,1,40,2,0,65,189,220,202,149,124,108,106,65,17,119,65,175,214,211,190,2,108,33,0,32,1,65,4,106,33,1,12,1,11,11,3,64,32,1,32,2,79,69,4,64,32,0,32,1,45,0,0,65,177,207,217,178,1,108,106,65,11,119,65,177,243,221,241,121,108,33,0,32,1,65,1,106,33,1,12,1,11,11,32,0,32,0,65,15,118,115,65,247,148,175,175,120,108,34,0,65,13,118,32,0,115,65,189,220,202,149,124,108,34,0,65,16,118,32,0,115,11,63,0,32,0,65,8,106,32,1,65,168,136,141,161,2,106,54,2,0,32,0,65,12,106,32,1,65,137,235,208,208,7,107,54,2,0,32,0,65,16,106,32,1,54,2,0,32,0,65,20,106,32,1,65,207,140,162,142,6,106,54,2,0,11,195,4,1,6,127,32,1,32,2,106,33,6,32,0,65,24,106,33,4,32,0,65,40,106,40,2,0,33,3,32,0,32,0,40,2,0,32,2,106,54,2,0,32,0,65,4,106,34,5,32,5,40,2,0,32,2,65,16,79,32,0,40,2,0,65,16,79,114,114,54,2,0,32,2,32,3,106,65,16,73,4,64,32,3,32,4,106,32,1,32,2,252,10,0,0,32,0,65,40,106,32,2,32,3,106,54,2,0,15,11,32,3,4,64,32,3,32,4,106,32,1,65,16,32,3,107,34,2,252,10,0,0,32,0,65,8,106,34,3,32,3,40,2,0,32,4,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,12,106,34,3,32,3,40,2,0,32,4,65,4,106,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,16,106,34,3,32,3,40,2,0,32,4,65,8,106,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,20,106,34,3,32,3,40,2,0,32,4,65,12,106,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,40,106,65,0,54,2,0,32,1,32,2,106,33,1,11,32,1,32,6,65,16,107,77,4,64,32,6,65,16,107,33,8,32,0,65,8,106,40,2,0,33,2,32,0,65,12,106,40,2,0,33,3,32,0,65,16,106,40,2,0,33,5,32,0,65,20,106,40,2,0,33,7,3,64,32,2,32,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,2,32,3,32,1,65,4,106,34,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,3,32,5,32,1,65,4,106,34,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,5,32,7,32,1,65,4,106,34,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,7,32,8,32,1,65,4,106,34,1,79,13,0,11,32,0,65,8,106,32,2,54,2,0,32,0,65,12,106,32,3,54,2,0,32,0,65,16,106,32,5,54,2,0,32,0,65,20,106,32,7,54,2,0,11,32,1,32,6,73,4,64,32,4,32,1,32,6,32,1,107,34,1,252,10,0,0,32,0,65,40,106,32,1,54,2,0,11,11,97,1,1,127,32,0,65,16,106,40,2,0,33,1,32,0,65,4,106,40,2,0,4,127,32,1,65,12,119,32,0,65,20,106,40,2,0,65,18,119,106,32,0,65,12,106,40,2,0,65,7,119,106,32,0,65,8,106,40,2,0,65,1,119,106,5,32,1,65,177,207,217,178,1,106,11,32,0,40,2,0,106,32,0,65,24,106,32,0,65,40,106,40,2,0,16,1,11,255,3,2,3,126,1,127,32,0,32,1,106,33,6,32,1,65,32,79,4,126,32,6,65,32,107,33,6,32,2,66,214,235,130,238,234,253,137,245,224,0,124,33,3,32,2,66,177,169,172,193,173,184,212,166,61,125,33,4,32,2,66,249,234,208,208,231,201,161,228,225,0,124,33,5,3,64,32,3,32,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,3,32,4,32,0,65,8,106,34,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,4,32,2,32,0,65,8,106,34,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,2,32,5,32,0,65,8,106,34,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,5,32,6,32,0,65,8,106,34,0,79,13,0,11,32,2,66,12,137,32,5,66,18,137,124,32,4,66,7,137,124,32,3,66,1,137,124,32,3,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,4,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,2,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,5,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,5,32,2,66,197,207,217,178,241,229,186,234,39,124,11,32,1,173,124,32,0,32,1,65,31,113,16,6,11,134,2,0,32,1,32,2,106,33,2,3,64,32,2,32,1,65,8,106,79,4,64,32,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,32,0,133,66,27,137,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,33,0,32,1,65,8,106,33,1,12,1,11,11,32,1,65,4,106,32,2,77,4,64,32,0,32,1,53,2,0,66,135,149,175,175,152,182,222,155,158,127,126,133,66,23,137,66,207,214,211,190,210,199,171,217,66,126,66,249,243,221,241,153,246,153,171,22,124,33,0,32,1,65,4,106,33,1,11,3,64,32,1,32,2,73,4,64,32,0,32,1,49,0,0,66,197,207,217,178,241,229,186,234,39,126,133,66,11,137,66,135,149,175,175,152,182,222,155,158,127,126,33,0,32,1,65,1,106,33,1,12,1,11,11,32,0,32,0,66,33,136,133,66,207,214,211,190,210,199,171,217,66,126,34,0,32,0,66,29,136,133,66,249,243,221,241,153,246,153,171,22,126,34,0,32,0,66,32,136,133,11,77,0,32,0,65,8,106,32,1,66,214,235,130,238,234,253,137,245,224,0,124,55,3,0,32,0,65,16,106,32,1,66,177,169,172,193,173,184,212,166,61,125,55,3,0,32,0,65,24,106,32,1,55,3,0,32,0,65,32,106,32,1,66,249,234,208,208,231,201,161,228,225,0,124,55,3,0,11,244,4,2,3,127,4,126,32,1,32,2,106,33,5,32,0,65,40,106,33,4,32,0,65,200,0,106,40,2,0,33,3,32,0,32,0,41,3,0,32,2,173,124,55,3,0,32,2,32,3,106,65,32,73,4,64,32,3,32,4,106,32,1,32,2,252,10,0,0,32,0,65,200,0,106,32,2,32,3,106,54,2,0,15,11,32,3,4,64,32,3,32,4,106,32,1,65,32,32,3,107,34,2,252,10,0,0,32,0,65,8,106,34,3,32,3,41,3,0,32,4,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,16,106,34,3,32,3,41,3,0,32,4,65,8,106,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,24,106,34,3,32,3,41,3,0,32,4,65,16,106,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,32,106,34,3,32,3,41,3,0,32,4,65,24,106,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,200,0,106,65,0,54,2,0,32,1,32,2,106,33,1,11,32,1,65,32,106,32,5,77,4,64,32,5,65,32,107,33,2,32,0,65,8,106,41,3,0,33,6,32,0,65,16,106,41,3,0,33,7,32,0,65,24,106,41,3,0,33,8,32,0,65,32,106,41,3,0,33,9,3,64,32,6,32,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,6,32,7,32,1,65,8,106,34,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,7,32,8,32,1,65,8,106,34,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,8,32,9,32,1,65,8,106,34,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,9,32,2,32,1,65,8,106,34,1,79,13,0,11,32,0,65,8,106,32,6,55,3,0,32,0,65,16,106,32,7,55,3,0,32,0,65,24,106,32,8,55,3,0,32,0,65,32,106,32,9,55,3,0,11,32,1,32,5,73,4,64,32,4,32,1,32,5,32,1,107,34,1,252,10,0,0,32,0,65,200,0,106,32,1,54,2,0,11,11,188,2,1,5,126,32,0,65,24,106,41,3,0,33,1,32,0,41,3,0,34,2,66,32,90,4,126,32,0,65,8,106,41,3,0,34,3,66,1,137,32,0,65,16,106,41,3,0,34,4,66,7,137,124,32,1,66,12,137,32,0,65,32,106,41,3,0,34,5,66,18,137,124,124,32,3,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,4,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,1,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,5,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,5,32,1,66,197,207,217,178,241,229,186,234,39,124,11,32,2,124,32,0,65,40,106,32,2,66,31,131,167,16,6,11]);return async function(){return function(t){const{exports:{mem:e,xxh32:n,xxh64:r,init32:i,update32:o,digest32:s,init64:u,update64:a,digest64:f}}=t;let c=new Uint8Array(e.buffer);function h(t,n){if(e.buffer.byteLength<t+n){const r=Math.ceil((t+n-e.buffer.byteLength)/65536);e.grow(r),c=new Uint8Array(e.buffer)}}function d(t,e,n,r,i,o){h(t);const s=new Uint8Array(t);return c.set(s),n(0,e),s.set(c.subarray(0,t)),{update(e){let n;return c.set(s),"string"==typeof e?(h(3*e.length,t),n=l.encodeInto(e,c.subarray(t)).written):(h(e.byteLength,t),c.set(e,t),n=e.byteLength),r(0,t,n),s.set(c.subarray(0,t)),this},digest:()=>(c.set(s),o(i(0)))}}function g(t){return t>>>0}const y=2n**64n-1n;function b(t){return t&y}const l=new TextEncoder,p=0,w=0n;function x(t,e=p){return h(3*t.length,0),g(n(0,l.encodeInto(t,c).written,e))}function L(t,e=w){return h(3*t.length,0),b(r(0,l.encodeInto(t,c).written,e))}return{h32:x,h32ToString:(t,e=p)=>x(t,e).toString(16).padStart(8,"0"),h32Raw:(t,e=p)=>(h(t.byteLength,0),c.set(t),g(n(0,t.byteLength,e))),create32:(t=p)=>d(48,t,i,o,s,g),h64:L,h64ToString:(t,e=w)=>L(t,e).toString(16).padStart(16,"0"),h64Raw:(t,e=w)=>(h(t.byteLength,0),c.set(t),b(r(0,t.byteLength,e))),create64:(t=w)=>d(88,t,u,a,f,b)}}((await WebAssembly.instantiate(t)).instance)}},"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof globalThis?globalThis:t||self).xxhash=e();
diff --git a/assets/scss/pages/posts/_toc.scss b/assets/scss/pages/posts/_toc.scss
index c9067deb..97b02bea 100644
--- a/assets/scss/pages/posts/_toc.scss
+++ b/assets/scss/pages/posts/_toc.scss
@@ -95,7 +95,6 @@
   display: block;
   position: sticky;
   box-sizing: border-box;
-  visibility: hidden;
   margin-bottom: 8rem;
   @include overflow-wrap(break-word);
   @include sticky-top-offset;
diff --git a/assets/scss/pages/shared/_fixit-decryptor.scss b/assets/scss/pages/shared/_fixit-decryptor.scss
index 6efa534a..b6e15e83 100644
--- a/assets/scss/pages/shared/_fixit-decryptor.scss
+++ b/assets/scss/pages/shared/_fixit-decryptor.scss
@@ -1,107 +1,192 @@
-@use "sass:color";
 @use "core/functions" as *;
 @use "core/mixins" as *;
-@use "variables" as *;
 
+// fixit-encryptor custom element
+fixit-encryptor {
+  display: block;
+}
+
+// Card container for the decryptor UI
 .fixit-decryptor-container {
-  font-family: fi-var(global-font-family);
   text-align: center;
   margin-block: fi-var(decryptor-margin-block);
+}
 
-  .fixit-decryptor-loading {
-    vertical-align: middle;
+// Form wrapper
+.fixit-decryptor-form {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 1.25rem;
+  max-width: 24rem;
+  margin-inline: auto;
+  padding: 1.5rem;
+  border: 1px solid fi-var(global-border-color);
+  transition: opacity 0.3s ease-out;
+  @include border-radius;
+  @include box-shadow(hover);
+}
+
+// Lock icon header
+.fixit-decryptor-header {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 3.5rem;
+  aspect-ratio: 1;
+  background-color: light-dark(fi-rgba(fi-var(primary), 0.1), fi-rgba(fi-var(primary), 0.15));
+  @include border-radius(full);
+}
+
+// Password input field with icon prefix
+.fixit-decryptor-field {
+  box-sizing: border-box;
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  width: 100%;
+  padding: 0 0.75rem;
+  border: 1px solid fi-var(global-border-color);
+  background-color: fi-var(global-background-color);
+  transition: border-color 0.2s ease, box-shadow 0.2s ease;
+  @include border-radius;
+
+  &:focus-within {
+    border-color: var(--fi-primary);
+    box-shadow: 0 0 0 2px light-dark(fi-rgba(fi-var(primary), 0.15), fi-rgba(fi-var(primary), 0.25));
   }
 
-  .fixit-decryptor-input,
-  .fixit-decryptor-btn,
-  .fixit-encryptor-btn {
-    display: none;
-    box-sizing: border-box;
-    outline: none;
-    color: fi-var(global-font-color);
-    border: 1px solid fi-var(global-border-color);
-    box-shadow: 0px 0px 5px 0px fi-var(global-border-color);
-    @include border-radius;
-    transition: all 0.1s ease-out;
-
-    &:active,
-    &:focus,
-    &:hover {
-      color: light-dark(color.adjust($global-link-hover-color, $lightness: -6%), color.adjust($global-link-hover-color-dark, $lightness: 6%));
-      border-color: fi-var(global-link-hover-color);
-      box-shadow: 0px 0px 5px 0px light-dark(
-        color.adjust($global-link-hover-color, $lightness: 20%),
-        color.adjust($global-link-hover-color-dark, $lightness: -20%)
-      );
-    }
-  }
-
-  .fixit-decryptor-input {
-    width: calc(clamp(50%, 450px, 100%) - 100px);
-    height: 3rem;
-    padding-left: 1rem;
-    padding-right: 1rem;
-    background-color: fi-var(global-background-color);
-  }
-
-  .fixit-decryptor-btn,
-  .fixit-encryptor-btn {
-    cursor: pointer;
-    padding: 0.8rem 1rem;
-    background-color: fi-var(global-background-color);
-    transition: all 0.1s ease-out;
-  }
-
-  .fixit-encryptor-btn {
-    display: none;
+  > i {
+    flex-shrink: 0;
+    color: fi-var(global-font-tertiary-color);
+    font-size: 0.8rem;
   }
 }
 
-fixit-encryptor {
-  &.initialized > .fixit-decryptor-container {
-    .fixit-decryptor-input,
-    .fixit-decryptor-btn {
-      display: inline-block;
-    }
+.fixit-decryptor-input {
+  flex: 1;
+  height: 2.5rem;
+  border: none;
+  outline: none;
+  background: transparent;
+  color: fi-var(global-font-color);
 
-    .fixit-decryptor-loading {
-      display: none;
-    }
-  }
-
-  cipher-text {
-    display: none !important;
+  &::placeholder {
+    color: fi-var(global-font-quaternary-color);
   }
 }
 
-// fixit-encryptor for for the encrypted pages
+// Unlock button
+.fixit-decryptor-btn {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 100%;
+  height: 2.5rem;
+  border: none;
+  background-color: fi-rgba(fi-var(primary), 0.95);
+  color: var(--fi-global-background-color, #fff);
+  font-weight: 500;
+  cursor: pointer;
+  transition: opacity 0.2s ease;
+  @include border-radius;
+
+  &:hover {
+    opacity: 0.85;
+  }
+}
+
+// Re-encrypt button (page-level, after decryption)
+.fixit-encryptor-btn {
+  display: none;
+  margin-top: 0.75rem;
+  width: 2.25rem;
+  height: 2.25rem;
+  padding: 0;
+  border: 1px solid fi-var(global-border-color);
+  border-radius: 50%;
+  background: none;
+  color: fi-var(global-font-tertiary-color);
+  font-size: 0.8rem;
+  cursor: pointer;
+  transition: color 0.2s ease, border-color 0.2s ease, background-color 0.2s ease;
+
+  &:hover {
+    color: fi-var(global-link-hover-color);
+    border-color: fi-var(global-link-hover-color);
+    background-color: light-dark(fi-rgba(fi-var(primary), 0.06), fi-rgba(fi-var(primary), 0.1));
+  }
+
+  .decrypted & {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+  }
+}
+
+// Page-level decryptor
 article fixit-encryptor {
   .fixit-decryptor-container {
     @include set-fi-var(decryptor-margin-block, 2rem);
   }
-  &.decrypted > .fixit-decryptor-container {
-    .fixit-decryptor-loading,
-    .fixit-decryptor-input,
-    .fixit-decryptor-btn {
-      display: none;
-    }
 
-    .fixit-encryptor-btn {
-      display: inline-block;
-    }
+  &.decrypted > .fixit-decryptor-container .fixit-decryptor-form {
+    display: none;
   }
 }
 
-// fixit-encryptor shortcodes
+// Fade-in when form becomes visible (e.g. page load or re-encrypt)
+@starting-style {
+  article fixit-encryptor > .fixit-decryptor-container .fixit-decryptor-form {
+    opacity: 0;
+  }
+}
+
+// Shortcode-level decryptor — connected input + button design
 #content fixit-encryptor {
   .fixit-decryptor-container {
     @include set-fi-var(decryptor-margin-block, 1rem);
   }
+
+  .fixit-decryptor-form {
+    flex-direction: row;
+    justify-content: center;
+    gap: 0;
+    max-width: 24rem;
+    padding: 0;
+    border: none;
+    border-radius: 0;
+  }
+
+  .fixit-decryptor-header {
+    display: none;
+  }
+
+  .fixit-decryptor-field {
+    flex: 1;
+    height: 2.5rem;
+    border-right: none;
+    border-radius: fi-var(global-border-radius) 0 0 fi-var(global-border-radius);
+
+    &:focus-within + .fixit-decryptor-btn {
+      border-color: var(--fi-primary);
+      box-shadow: 0 0 0 2px light-dark(fi-rgba(fi-var(primary), 0.15), fi-rgba(fi-var(primary), 0.25));
+    }
+  }
+
+  .fixit-decryptor-btn {
+    width: auto;
+    padding: 0 0.85rem;
+    border-radius: 0 fi-var(global-border-radius) fi-var(global-border-radius) 0;
+    transition: border-color 0.2s ease, box-shadow 0.2s ease;
+  }
+
   &.decrypted > .fixit-decryptor-container {
     display: none;
   }
 }
 
+// Hidden elements for encrypted pages
 .encrypted-hidden {
   display: none !important;
 }
diff --git a/build.sh b/build.sh
index 0eccdb6b..49443c85 100644
--- a/build.sh
+++ b/build.sh
@@ -106,6 +106,10 @@ main() {
   wait "${pid_demo}" || { echo "build demo failed"; exit 1; }
   wait "${pid_test}" || { echo "build test failed"; exit 1; }
   pnpm -F integration start
+
+  # Post-process encrypted content and verify encryption output.
+  pnpm encrypt
+  pnpm encrypt --verify
 }
 
 main "$@"
diff --git a/hugo.toml b/hugo.toml
index a6695767..76b4ea87 100644
--- a/hugo.toml
+++ b/hugo.toml
@@ -432,6 +432,14 @@ category = "categories"
 tag = "tags"
 collection = "collections"
 
+# -------------------------------------------------------------------------------------
+# Build Configuration
+# See: https://gohugo.io/configuration/build/
+# -------------------------------------------------------------------------------------
+
+[build]
+noJSConfigInAssets = true
+
 # -------------------------------------------------------------------------------------
 # Theme Core Configuration
 # Two types of params:
diff --git a/i18n/de.toml b/i18n/de.toml
index 41a90809..1a7bc6da 100644
--- a/i18n/de.toml
+++ b/i18n/de.toml
@@ -145,6 +145,8 @@ encryptedMessage = "Bitte geben Sie das Passwort ein"
 password = "Passwort"
 enterBtn = "Eintreten"
 encryptyAgain = "Erneut verschlüsseln"
+encryptionWarning = "Inhaltsverschlüsselung erkannt, aber sie sind noch im Klartext!"
+encryptionCommand = "Führen Sie `npx @hugo-fixit/post-encrypt` nach dem Build aus, um sie tatsächlich zu verschlüsseln."
 relatedContent = "Ähnliche Inhalte"
 
 [single.includedIn]
diff --git a/i18n/en.toml b/i18n/en.toml
index c0b7a3fe..7fd04252 100644
--- a/i18n/en.toml
+++ b/i18n/en.toml
@@ -145,6 +145,8 @@ encryptedMessage = "Please enter the password"
 password = "Password"
 enterBtn = "Enter"
 encryptyAgain = "Encrypt again"
+encryptionWarning = "Content encryption detected, but they are still in plaintext!"
+encryptionCommand = "Run `npx @hugo-fixit/post-encrypt` after building to actually encrypt them."
 relatedContent = "Related Content"
 
 [single.includedIn]
diff --git a/i18n/es.toml b/i18n/es.toml
index 25ba2565..224a25a4 100644
--- a/i18n/es.toml
+++ b/i18n/es.toml
@@ -145,6 +145,8 @@ encryptedMessage = "Por favor, ingrese la contraseña"
 password = "Contraseña"
 enterBtn = "Entrar"
 encryptyAgain = "Encriptar de nuevo"
+encryptionWarning = "¡Se detectó cifrado de contenido, pero aún están en texto plano!"
+encryptionCommand = "Ejecute `npx @hugo-fixit/post-encrypt` después de la compilación para cifrarlos realmente."
 relatedContent = "Contenido relacionado"
 
 [single.includedIn]
diff --git a/i18n/fr.toml b/i18n/fr.toml
index 3e052f59..eba6ca8e 100644
--- a/i18n/fr.toml
+++ b/i18n/fr.toml
@@ -145,6 +145,8 @@ encryptedMessage = "Entrer le mot de passe"
 password = "Mot de passe"
 enterBtn = "Entrer"
 encryptyAgain = "Chiffrer à nouveau"
+encryptionWarning = "Chiffrement de contenu détecté, mais ils sont toujours en texte clair !"
+encryptionCommand = "Exécutez `npx @hugo-fixit/post-encrypt` après la compilation pour les chiffrer réellement."
 relatedContent = "Contenu lié"
 
 [single.includedIn]
diff --git a/i18n/hi.toml b/i18n/hi.toml
index 7ce581bf..bc949ae3 100644
--- a/i18n/hi.toml
+++ b/i18n/hi.toml
@@ -146,6 +146,8 @@ encryptedMessage = "कृपया पासवर्ड दर्ज करे
 password = "पासवर्ड"
 enterBtn = "दर्ज करें"
 encryptyAgain = "फिर से एन्क्रिप्ट करें"
+encryptionWarning = "सामग्री एन्क्रिप्शन का पता चला, लेकिन वे अभी भी सादे पाठ में हैं!"
+encryptionCommand = "उन्हें वास्तव में एन्क्रिप्ट करने के लिए बिल्ड के बाद `npx @hugo-fixit/post-encrypt` चलाएं।"
 relatedContent = "संबंधित सामग्री"
 
 [single.includedIn]
diff --git a/i18n/it.toml b/i18n/it.toml
index 6a59e8a7..88fb8c36 100644
--- a/i18n/it.toml
+++ b/i18n/it.toml
@@ -145,6 +145,8 @@ encryptedMessage = "Per favore inserisci la password"
 password = "Password"
 enterBtn = "Entra"
 encryptyAgain = "Crittografa di nuovo"
+encryptionWarning = "Rilevata crittografia dei contenuti, ma sono ancora in testo in chiaro!"
+encryptionCommand = "Eseguire `npx @hugo-fixit/post-encrypt` dopo la compilazione per crittograffarli effettivamente."
 relatedContent = "Contenuti correlati"
 
 [single.includedIn]
diff --git a/i18n/ja.toml b/i18n/ja.toml
index 1b76c483..af18be30 100644
--- a/i18n/ja.toml
+++ b/i18n/ja.toml
@@ -143,6 +143,8 @@ encryptedMessage = "パスワードを入力してください"
 password = "パスワード"
 enterBtn = "入る"
 encryptyAgain = "再度暗号化"
+encryptionWarning = "コンテンツの暗号化が検出されましたが、まだ平文です！"
+encryptionCommand = "実際に暗号化するには、ビルド後に `npx @hugo-fixit/post-encrypt` を実行してください。"
 relatedContent = "関連コンテンツ"
 
 [single.includedIn]
diff --git a/i18n/ko.toml b/i18n/ko.toml
index 8b144b96..6e984943 100644
--- a/i18n/ko.toml
+++ b/i18n/ko.toml
@@ -143,6 +143,8 @@ encryptedMessage = "비밀번호를 입력하세요"
 password = "비밀번호"
 enterBtn = "입장"
 encryptyAgain = "다시 암호화"
+encryptionWarning = "콘텐츠 암호화가 감지되었지만 여전히 평문입니다!"
+encryptionCommand = "실제로 암호화하려면 빌드 후 `npx @hugo-fixit/post-encrypt`를 실행하세요."
 relatedContent = "관련 콘텐츠"
 
 [single.includedIn]
diff --git a/i18n/pl.toml b/i18n/pl.toml
index e915e64e..8ac2df0f 100644
--- a/i18n/pl.toml
+++ b/i18n/pl.toml
@@ -145,6 +145,8 @@ encryptedMessage = "Proszę wprowadzić hasło"
 password = "Hasło"
 enterBtn = "Wejdź"
 encryptyAgain = "Zaszyfruj ponownie"
+encryptionWarning = "Wykryto szyfrowanie treści, ale nadal są w postaci zwykłego tekstu!"
+encryptionCommand = "Uruchom `npx @hugo-fixit/post-encrypt` po kompilacji, aby je faktycznie zaszyfrować."
 relatedContent = "Powiązane treści"
 
 [single.includedIn]
diff --git a/i18n/pt-BR.toml b/i18n/pt-BR.toml
index 37fafb94..cfa430b0 100644
--- a/i18n/pt-BR.toml
+++ b/i18n/pt-BR.toml
@@ -146,6 +146,8 @@ encryptedMessage = "Por favor, insira a senha"
 password = "Senha"
 enterBtn = "Entrar"
 encryptyAgain = "Encripte novamente"
+encryptionWarning = "Criptografia de conteúdo detectada, mas ainda estão em texto plano!"
+encryptionCommand = "Execute `npx @hugo-fixit/post-encrypt` após a compilação para realmente criptografá-los."
 relatedContent = "Conteúdo relacionado"
 
 [single.includedIn]
diff --git a/i18n/ro.toml b/i18n/ro.toml
index 758c7903..84c89b57 100644
--- a/i18n/ro.toml
+++ b/i18n/ro.toml
@@ -145,6 +145,8 @@ encryptedMessage = "Vă rugăm să introduceți parola"
 password = "Parolă"
 enterBtn = "Intră"
 encryptyAgain = "Criptează din nou"
+encryptionWarning = "Criptarea conținutului a fost detectată, dar sunt încă în text clar!"
+encryptionCommand = "Rulați `npx @hugo-fixit/post-encrypt` după compilare pentru a le cripta efectiv."
 relatedContent = "Conținut înrudit"
 
 [single.includedIn]
diff --git a/i18n/ru.toml b/i18n/ru.toml
index 2501e21e..430958f5 100644
--- a/i18n/ru.toml
+++ b/i18n/ru.toml
@@ -145,6 +145,8 @@ encryptedMessage = "Пожалуйста, введите пароль"
 password = "арготизм"
 enterBtn = "Войти"
 encryptyAgain = "Зашифровать снова"
+encryptionWarning = "Обнаружено шифрование контента, но он всё ещё в открытом виде!"
+encryptionCommand = "Запустите `npx @hugo-fixit/post-encrypt` после сборки, чтобы фактически зашифровать их."
 relatedContent = "Связанный контент"
 
 [single.includedIn]
diff --git a/i18n/sr.toml b/i18n/sr.toml
index 403ee97b..f11e92ca 100644
--- a/i18n/sr.toml
+++ b/i18n/sr.toml
@@ -145,6 +145,8 @@ encryptedMessage = "Унесите лозинку да бисте видели 
 password = "Паролица"
 enterBtn = "Унеси"
 encryptyAgain = "Поново шифруј"
+encryptionWarning = "Детектовано је шифровање садржаја, али су и даље у обичном тексту!"
+encryptionCommand = "Покрените `npx @hugo-fixit/post-encrypt` након изградње да бисте их заиста шифровали."
 relatedContent = "Повезани садржај"
 
 [single.includedIn]
diff --git a/i18n/vi.toml b/i18n/vi.toml
index c107597d..6828c4d3 100644
--- a/i18n/vi.toml
+++ b/i18n/vi.toml
@@ -144,6 +144,8 @@ encryptedMessage = "Vui lòng nhập mật khẩu"
 password = "Mật khẩu"
 enterBtn = "Nhập"
 encryptyAgain = "Mã hóa lại"
+encryptionWarning = "Phát hiện mã hóa nội dung, nhưng chúng vẫn ở dạng văn bản thuần!"
+encryptionCommand = "Chạy `npx @hugo-fixit/post-encrypt` sau khi build để thực sự mã hóa chúng."
 relatedContent = "Nội dung liên quan"
 
 [single.includedIn]
diff --git a/i18n/zh-CN.toml b/i18n/zh-CN.toml
index 1ff12b65..77c5e952 100644
--- a/i18n/zh-CN.toml
+++ b/i18n/zh-CN.toml
@@ -143,6 +143,8 @@ encryptedMessage = "请输入密码"
 password = "密码"
 enterBtn = "进入"
 encryptyAgain = "重新加密"
+encryptionWarning = "检测到内容加密，但仍为明文状态！"
+encryptionCommand = "请在构建后执行 `npx @hugo-fixit/post-encrypt` 以实际加密内容。"
 relatedContent = "相关内容"
 
 [single.includedIn]
diff --git a/i18n/zh-TW.toml b/i18n/zh-TW.toml
index a21b7027..500ceec7 100644
--- a/i18n/zh-TW.toml
+++ b/i18n/zh-TW.toml
@@ -143,6 +143,8 @@ encryptedMessage = "請輸入密碼"
 password = "密碼"
 enterBtn = "進入"
 encryptyAgain = "重新加密"
+encryptionWarning = "偵測到內容加密，但仍為明文狀態！"
+encryptionCommand = "請在建構後執行 `npx @hugo-fixit/post-encrypt` 以實際加密內容。"
 relatedContent = "相關內容"
 
 [single.includedIn]
diff --git a/layouts/_partials/base/assets.html b/layouts/_partials/base/assets.html
index a0392ac3..47c75a4a 100644
--- a/layouts/_partials/base/assets.html
+++ b/layouts/_partials/base/assets.html
@@ -270,14 +270,6 @@
 {{- /* Content Decryption */ -}}
 {{- $encryptPartial := .Store.Get "hasEncryptor" -}}
 {{- if .Params.password | or $encryptPartial -}}
-  {{- $cryptoCoreJS := $cdn.cryptoCoreJS | default "lib/crypto-js/core.js" -}}
-  {{- $cryptoEncBase64JS := $cdn.cryptoEncBase64JS | default "lib/crypto-js/enc-base64.js" -}}
-  {{- $cryptoSha256JS := $cdn.cryptoSha256JS | default "lib/crypto-js/sha256.js" -}}
-  {{- $xxhashWasmJS := $cdn.xxhashWasmJS | default "lib/xxhash-wasm/xxhash-wasm.js" -}}
-  {{- dict "Source" $cryptoCoreJS "Minify" hugo.IsProduction "Fingerprint" $fingerprint "Defer" true | dict "Page" . "Data" | partial "store/script.html" -}}
-  {{- dict "Source" $cryptoEncBase64JS "Minify" hugo.IsProduction "Fingerprint" $fingerprint "Defer" true | dict "Page" . "Data" | partial "store/script.html" -}}
-  {{- dict "Source" $cryptoSha256JS "Minify" hugo.IsProduction "Fingerprint" $fingerprint "Defer" true | dict "Page" . "Data" | partial "store/script.html" -}}
-  {{- dict "Source" $xxhashWasmJS "Minify" hugo.IsProduction "Fingerprint" $fingerprint "Defer" true | dict "Page" . "Data" | partial "store/script.html" -}}
   {{- /* Decryption script */ -}}
   {{- dict "Source" "js/lib/fixit-decryptor.ts" "Build" true "Fingerprint" $fingerprint "Defer" true | dict "Page" . "Data" | partial "store/script.html" -}}
   {{- $config = dict "all" (.Params.password | not | not) "shortcode" ($encryptPartial | default false) | dict "encryption" | merge $config -}}
diff --git a/layouts/_partials/function/content-encryption.html b/layouts/_partials/function/content-encryption.html
deleted file mode 100644
index cbec6875..00000000
--- a/layouts/_partials/function/content-encryption.html
+++ /dev/null
@@ -1,15 +0,0 @@
-{{- $content := .Content -}}
-
-{{- /* If Hugo Support AES, refactor with AES. */ -}}
-{{- if .Password -}}
-  {{- $saltLen := strings.RuneCount (trim .Password " ") -}}
-  {{- $saltLen = cond (eq (mod $saltLen 2) 0) (add $saltLen 1) $saltLen -}}
-  {{- $base64EncodeContent := $content | base64Encode -}}
-  {{- $content = printf "%v%v%v"
-    (substr $base64EncodeContent 0 $saltLen)
-    (substr (sha256 .Password) $saltLen)
-    (substr $base64EncodeContent $saltLen)
-  -}}
-{{- end -}}
-
-{{- return $content -}}
diff --git a/layouts/_partials/init/detection-encryption.html b/layouts/_partials/init/detection-encryption.html
new file mode 100644
index 00000000..685e8912
--- /dev/null
+++ b/layouts/_partials/init/detection-encryption.html
@@ -0,0 +1,11 @@
+{{- if eq .Site hugo.Sites.Default -}}
+  {{- $encryptedPages := slice -}}
+  {{- range .Site.RegularPages -}}
+    {{- if or .Params.password (.Store.Get "hasEncryptor") -}}
+      {{- $encryptedPages = $encryptedPages | append (printf " • %s: %s" .Title .Permalink) -}}
+    {{- end -}}
+  {{- end -}}
+  {{- with $encryptedPages -}}
+    {{- warnf "[FixIt] %s\n%s\n%s" (T "single.encryptionWarning") (delimit . "\n") (T "single.encryptionCommand") -}}
+  {{- end -}}
+{{- end -}}
diff --git a/layouts/_partials/init/index.html b/layouts/_partials/init/index.html
index c6ca49fe..10ac8a25 100644
--- a/layouts/_partials/init/index.html
+++ b/layouts/_partials/init/index.html
@@ -5,5 +5,6 @@
 {{- partial "init/detection-version.html" . -}}
 {{- partial "init/detection-deprecated.html" . -}}
 {{- partial "init/detection-pagefind.html" . -}}
+{{- partial "init/detection-encryption.html" . -}}
 {{- partial "init/global.html" . -}}
 {{- partial "init/compatibility.html" . -}}
diff --git a/layouts/_partials/plugin/fixit-encryptor.html b/layouts/_partials/plugin/fixit-encryptor.html
index d0429437..a9d74cd8 100644
--- a/layouts/_partials/plugin/fixit-encryptor.html
+++ b/layouts/_partials/plugin/fixit-encryptor.html
@@ -1,41 +1,43 @@
 {{- /*
   Encrypted content renderer.
-  - Encrypts content payload and renders decryptor UI.
+  - Renders template placeholder for post-build AES-256-GCM encryption.
   - Supports full-page mode and partial mode with isolated target container.
   @param {String} .Password - Encryption password
-  @param {String} .Content - Content to encrypt and render
+  @param {String} .Content - Plaintext content (encrypted by post-build script)
   @param {String} [.Message] - Custom input placeholder message
   @param {Boolean} [.IsPartial] - Whether current render is partial mode
   @param {Object} [.Page] - Current page context (required when IsPartial is true)
 */ -}}
 
 {{- if .Password -}}
-  {{- /* Content Encryption */ -}}
-  {{- $content := dict "Content" .Content "Password" .Password | partial "function/content-encryption.html" -}}
-
   {{- /* Generating fixit-encryptor DOM */ -}}
   {{- $message := .Message | default (T "single.encryptedMessage") -}}
-  {{- $loading := resources.Get "images/loading.svg" | minify -}}
   {{- $id := "fixit-decryptor-input" -}}
   {{- if .IsPartial -}}
     {{- $id = dict "Page" .Page | partial "function/id.html" -}}
   {{- end -}}
   <fixit-encryptor data-pagefind-ignore="all">
     <div class="fixit-decryptor-container">
-      <img class="fixit-decryptor-loading" src="{{ $loading.RelPermalink }}" alt="decryptor loading" width="48" height="48" />
-      <label for="{{ $id }}" title="{{ T `single.password` }}">
-        <input type="password" id="{{ $id }}" class="fixit-decryptor-input" placeholder="🔑 {{ $message }}" />
-      </label>
-      <button class="fixit-decryptor-btn">
-        {{- dict "Class" "fa-solid fa-unlock" | partial "plugin/icon.html" }}{{ T "single.enterBtn" -}}
-      </button>
+      <div class="fixit-decryptor-form">
+        <div class="fixit-decryptor-header">
+          <i class="fixit-decryptor-icon fa-solid fa-lock"></i>
+        </div>
+        <label for="{{ $id }}" class="sr-only">{{ T `single.password` }}</label>
+        <div class="fixit-decryptor-field">
+          <i class="fa-solid fa-key"></i>
+          <input type="password" id="{{ $id }}" class="fixit-decryptor-input max-sm:w-full" placeholder="{{ $message }}" />
+        </div>
+        <button class="fixit-decryptor-btn">
+          {{- dict "Class" "fa-solid fa-unlock-keyhole me-1.5" | partial "plugin/icon.html" }}{{ T "single.enterBtn" -}}
+        </button>
+      </div>
       {{- if not .IsPartial -}}
-        <button class="fixit-encryptor-btn">
-          {{- dict "Class" "fa-solid fa-lock" | partial "plugin/icon.html" }}{{ T "single.encryptyAgain" -}}
+        <button class="fixit-encryptor-btn" title="{{ T `single.encryptyAgain` }}">
+          {{- dict "Class" "fa-solid fa-lock" | partial "plugin/icon.html" -}}
         </button>
       {{- end -}}
     </div>
     {{- if .IsPartial }}<div class="decryptor-content"></div>{{ end -}}
-    <cipher-text data-password="{{ xxhash .Password }}">{{ $content }}</cipher-text>
+    <template data-password="{{ sha256 .Password }}">{{ .Content }}</template>
   </fixit-encryptor>
 {{- end -}}
diff --git a/layouts/posts/single.html b/layouts/posts/single.html
index cc6c3175..9a90abb2 100644
--- a/layouts/posts/single.html
+++ b/layouts/posts/single.html
@@ -150,17 +150,17 @@
       </div>
     {{- end -}}
 
-    {{- /* Static TOC */ -}}
     {{- if $showToc -}}
+      {{- /* Static TOC */ -}}
       <div class="details toc{{ with .Params.password }} encrypted-hidden{{ end }}" id="toc-static" data-kept="{{ if $toc.keep_static }}true{{ else }}false{{ end }}">
         <div class="details-summary toc-title">
           <span>{{ T "single.contents" }}</span>
           <span>{{ dict "Class" "details-icon fa-solid fa-angle-right" | partial "plugin/icon.html" }}</span>
         </div>
-        <div class="details-content toc-content" id="toc-content-static">
-          {{- $tableOfContents -}}
-        </div>
+        <div class="details-content toc-content" id="toc-content-static"></div>
       </div>
+      {{- /* TOC source (copied to containers by initToc, encrypted by post-encrypt when password is set) */ -}}
+      <template data-toc{{ with .Params.password }} data-password="{{ sha256 . }}"{{ end }}>{{ $tableOfContents }}</template>
     {{- end -}}
 
     {{- /* AI Summary */ -}}
@@ -172,6 +172,11 @@
     {{- /* Custom block before post content */ -}}
     {{- block "custom-post__content:before" . }}{{ end -}}
 
+    {{- /* Encryption Dev Warning */ -}}
+    {{- if (.Params.password | or (.Store.Get "hasEncryptor")) | and (not hugo.IsProduction) -}}
+      {{- dict "Type" "danger" "Title" (printf "%s<br>%s" (T "single.encryptionWarning") (T "single.encryptionCommand") | $.RenderString) "Foldable" false | partial "plugin/admonition.html" -}}
+    {{- end -}}
+
     {{- /* Expiration Reminder */ -}}
     {{- partial "single/expiration-reminder.html" . -}}
 
@@ -216,7 +221,7 @@
     {{- block "custom-post__footer:after" . }}{{ end -}}
   </article>
 
-  <aside class="toc" id="toc-auto" aria-label="{{ T "single.contents" }}">
+  <aside class="toc animate__animated animate__fadeIn animate__faster" id="toc-auto" aria-label="{{ T "single.contents" }}">
     {{- /* Custom block before post toc */ -}}
     {{- block "custom-post__toc:before" . }}{{ end -}}
 
@@ -241,9 +246,7 @@
       </button>
       <div class="toc">
         <h2 class="toc-title" id="toc-dialog-title">{{ T "single.contents" }}</h2>
-        <div class="toc-content" id="toc-content-drawer">
-          {{- replace $tableOfContents `id="TableOfContents"` "" | safeHTML -}}
-        </div>
+        <div class="toc-content" id="toc-content-drawer"></div>
       </div>
     </dialog>
   {{- end -}}
diff --git a/librarybot.yml b/librarybot.yml
index 34e705db..1218a98d 100644
--- a/librarybot.yml
+++ b/librarybot.yml
@@ -47,16 +47,6 @@ libraries:
           to: cookieconsent/cookieconsent.min.css
         - from: build/cookieconsent.min.js
           to: cookieconsent/cookieconsent.min.js
-  - npm: crypto-js
-    version: 4.2.0
-    local:
-      items:
-        - from: core.js
-          to: crypto-js/core.js
-        - from: enc-base64.js
-          to: crypto-js/enc-base64.js
-        - from: sha256.js
-          to: crypto-js/sha256.js
   - npm: echarts
     version: 6.1.0
     local:
@@ -219,9 +209,3 @@ libraries:
           to: waline/waline.css
         - from: dist/waline.umd.js
           to: waline/waline.umd.js
-  - npm: xxhash-wasm
-    version: 1.1.0
-    local:
-      items:
-        - from: umd/xxhash-wasm.js
-          to: xxhash-wasm/xxhash-wasm.js
diff --git a/package.json b/package.json
index a1f8e08c..1766ada1 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,8 @@
     "dev:docs": "hugo server --source=../fixit-docs -D --disableFastRender --navigateToChanged --ignoreCache -O",
     "build:demo": "pnpm -F demo build",
     "build:test": "pnpm -F test build",
-    "build": "concurrently 'pnpm build:demo' 'pnpm build:test' && pnpm -F integration start",
+    "build": "concurrently 'pnpm build:demo' 'pnpm build:test' && pnpm -F integration start && pnpm encrypt && pnpm encrypt --verify",
+    "encrypt": "pnpm -F post-encrypt start",
     "clean": "rm -rf public resources/_gen apps/*/public apps/*/resources/_gen",
     "preview": "serve public",
     "lint": "eslint --cache .",
diff --git a/packages/chroma-lexers/src/index.ts b/packages/chroma-lexers/src/index.ts
index 98926fa9..afe2a9fd 100644
--- a/packages/chroma-lexers/src/index.ts
+++ b/packages/chroma-lexers/src/index.ts
@@ -5,3 +5,5 @@ export default async function main() {
   const lexers = await fetchLexers()
   generateScss(lexers)
 }
+
+main()
diff --git a/packages/post-encrypt/README.md b/packages/post-encrypt/README.md
new file mode 100644
index 00000000..e5be3956
--- /dev/null
+++ b/packages/post-encrypt/README.md
@@ -0,0 +1,54 @@
+# @hugo-fixit/post-encrypt
+
+Post-build AES-256-GCM encryption tool for the [FixIt](https://github.com/hugo-fixit/FixIt) Hugo theme.
+
+## Usage
+
+After building your Hugo site, run the encryption tool from your site root:
+
+```bash
+npx @hugo-fixit/post-encrypt --input public
+```
+
+### Options
+
+| Option | Description | Default |
+| --- | --- | --- |
+| `--input <dir>` | Input directory containing HTML files | `public` |
+| `--dry-run | Show which files would be modified without writing | `false` |
+| `--verify | Verify all encryption templates are encrypted | `false` |
+
+### Examples
+
+```bash
+# Encrypt content in the default public/ directory
+npx @hugo-fixit/post-encrypt
+
+# Encrypt content in a custom directory
+npx @hugo-fixit/post-encrypt --input dist
+
+# Verify encryption without modifying files
+npx @hugo-fixit/post-encrypt --verify
+
+# Dry run to see which files would be changed
+npx @hugo-fixit/post-encrypt --dry-run
+```
+
+## How It Works
+
+1. Scans all `.html` files in the input directory
+2. Finds `<template data-password="...">` elements (encryption placeholders)
+3. Encrypts the plaintext content using AES-256-GCM with PBKDF2 key derivation
+4. Replaces the `data-password` hash with a PBKDF2-protected version
+5. Writes the encrypted payload back to the template element
+
+### Security
+
+- **Algorithm**: AES-256-GCM (authenticated encryption)
+- **Key derivation**: PBKDF2 with 100,000 iterations and random 16-byte salt
+- **Password verification**: PBKDF2-protected hash (not raw SHA-256)
+- **Payload format**: `base64(salt).base64(iv).base64(ciphertext+tag)`
+
+## License
+
+MIT
diff --git a/packages/post-encrypt/package.json b/packages/post-encrypt/package.json
new file mode 100644
index 00000000..d916e2ac
--- /dev/null
+++ b/packages/post-encrypt/package.json
@@ -0,0 +1,39 @@
+{
+  "name": "@hugo-fixit/post-encrypt",
+  "type": "module",
+  "version": "0.1.0",
+  "description": "Post-build AES-256-GCM encryption tool for the FixIt Hugo theme",
+  "author": "Lruihao",
+  "license": "MIT",
+  "homepage": "https://github.com/hugo-fixit/FixIt/tree/feat/post-encrypt/packages/post-encrypt#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hugo-fixit/FixIt.git",
+    "directory": "packages/post-encrypt"
+  },
+  "bugs": {
+    "url": "https://github.com/hugo-fixit/FixIt/issues"
+  },
+  "keywords": [
+    "hugo",
+    "fixit",
+    "encryption",
+    "aes-256-gcm",
+    "post-build"
+  ],
+  "main": "./dist/index.js",
+  "bin": {
+    "post-encrypt": "./dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "start": "tsx src/index.ts",
+    "prepublishOnly": "pnpm build"
+  },
+  "dependencies": {
+    "consola": "^3.4.2"
+  }
+}
diff --git a/packages/post-encrypt/src/index.ts b/packages/post-encrypt/src/index.ts
new file mode 100644
index 00000000..c3d19ebb
--- /dev/null
+++ b/packages/post-encrypt/src/index.ts
@@ -0,0 +1,313 @@
+#!/usr/bin/env node
+import { Buffer } from 'node:buffer'
+import { createCipheriv, pbkdf2Sync, randomBytes } from 'node:crypto'
+import { readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import consola from 'consola'
+
+const AES_CIPHER = 'aes-256-gcm'
+const AES_MARKER = 'aes-256-gcm-v2'
+const PBKDF2_ITERATIONS = 100_000
+const SALT_LENGTH = 16
+const IV_LENGTH = 12
+const OPEN_TAG = '<template'
+const CLOSE_TAG = '</template>'
+
+interface CliOptions {
+  input: string
+  cwd: string
+  dryRun: boolean
+  verifyOnly: boolean
+}
+
+interface TemplateMatch {
+  openStart: number
+  openEnd: number
+  closeStart: number
+  closeEnd: number
+  attrs: string
+  content: string
+}
+
+function parseArgs(argv: string[]): CliOptions {
+  // INIT_CWD is set by pnpm to the original working directory
+  const options: CliOptions = {
+    input: 'public',
+    cwd: process.env.INIT_CWD || process.cwd(),
+    dryRun: false,
+    verifyOnly: false,
+  }
+
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]
+    if (arg === '--input') {
+      options.input = argv[i + 1] || options.input
+      i++
+      continue
+    }
+    if (arg.startsWith('--input=')) {
+      options.input = arg.slice('--input='.length)
+      continue
+    }
+    if (arg === '--dry-run') {
+      options.dryRun = true
+      continue
+    }
+    if (arg === '--verify') {
+      options.verifyOnly = true
+      continue
+    }
+  }
+
+  return options
+}
+
+function collectHtmlFiles(targetDir: string): string[] {
+  const files: string[] = []
+
+  function walk(dir: string) {
+    for (const name of readdirSync(dir)) {
+      const fullPath = path.join(dir, name)
+      const stat = statSync(fullPath)
+      if (stat.isDirectory()) {
+        walk(fullPath)
+        continue
+      }
+      if (stat.isFile() && fullPath.endsWith('.html')) {
+        files.push(fullPath)
+      }
+    }
+  }
+
+  walk(targetDir)
+  return files
+}
+
+/**
+ * Find all matching `<template>...</template>` pairs with depth tracking.
+ * Only returns pairs whose open tag has `data-password` (encryption templates).
+ */
+function findEncryptionTemplates(html: string): TemplateMatch[] {
+  const allMatches: TemplateMatch[] = []
+  const opens: number[] = []
+  const closes: number[] = []
+
+  let pos = 0
+  while (pos < html.length) {
+    const openIdx = html.indexOf(OPEN_TAG, pos)
+    const closeIdx = html.indexOf(CLOSE_TAG, pos)
+
+    if (openIdx === -1 && closeIdx === -1)
+      break
+
+    if (openIdx !== -1 && (closeIdx === -1 || openIdx < closeIdx)) {
+      opens.push(openIdx)
+      pos = openIdx + OPEN_TAG.length
+    }
+    else {
+      closes.push(closeIdx)
+      pos = closeIdx + CLOSE_TAG.length
+    }
+  }
+
+  // Match open/close pairs using a stack
+  const stack: number[] = []
+  const pairs: Array<{ open: number, close: number }> = []
+
+  let oi = 0
+  let ci = 0
+  while (oi < opens.length || ci < closes.length) {
+    if (oi < opens.length && (ci >= closes.length || opens[oi] < closes[ci])) {
+      stack.push(opens[oi])
+      oi++
+    }
+    else {
+      if (stack.length > 0) {
+        pairs.push({ open: stack.pop()!, close: closes[ci] })
+      }
+      ci++
+    }
+  }
+
+  // Extract match details, filtering to encryption templates only
+  for (const { open, close } of pairs) {
+    const openEnd = html.indexOf('>', open)
+    if (openEnd === -1 || openEnd > close)
+      continue
+
+    const attrs = html.slice(open + OPEN_TAG.length, openEnd)
+    // Skip non-encryption templates (those without data-password)
+    if (!/\bdata-password\s*=/.test(attrs))
+      continue
+
+    const content = html.slice(openEnd + 1, close)
+    const closeEnd = close + CLOSE_TAG.length
+    allMatches.push({ openStart: open, openEnd: openEnd + 1, closeStart: close, closeEnd, attrs, content })
+  }
+
+  return allMatches
+}
+
+/**
+ * Check if a match's content contains nested unencrypted encryption templates.
+ * Already-encrypted nested blocks (with data-cipher) are ignored.
+ */
+function hasNestedUnencryptedTemplate(match: TemplateMatch): boolean {
+  const regex = /<template\b(?=[^>]+\bdata-password\b)(?![^>]+\bdata-cipher\s*=)/
+  return regex.test(match.content)
+}
+
+function deriveKey(passwordHash: string, salt: Buffer): Buffer {
+  return pbkdf2Sync(passwordHash, salt, PBKDF2_ITERATIONS, 32, 'sha256')
+}
+
+/**
+ * Derive a verification hash from the SHA-256 password hash using PBKDF2.
+ * This replaces the raw SHA-256 hash stored in `data-password`, making brute-force attacks harder.
+ */
+function deriveVerificationHash(passwordHash: string): { hash: string, salt: Buffer } {
+  const salt = randomBytes(SALT_LENGTH)
+  const hash = pbkdf2Sync(passwordHash, salt, PBKDF2_ITERATIONS, 32, 'sha256').toString('hex')
+  return { hash, salt }
+}
+
+function encryptPayload(plaintext: string, passwordHash: string): string {
+  const salt = randomBytes(SALT_LENGTH)
+  const iv = randomBytes(IV_LENGTH)
+  const key = deriveKey(passwordHash, salt)
+  const cipher = createCipheriv(AES_CIPHER, key, iv)
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext, 'utf8'),
+    cipher.final(),
+  ])
+  const tag = cipher.getAuthTag()
+  const encryptedWithTag = Buffer.concat([encrypted, tag])
+  return `${salt.toString('base64')}.${iv.toString('base64')}.${encryptedWithTag.toString('base64')}`
+}
+
+function encryptTemplatesInHtml(html: string): { content: string, changed: boolean } {
+  let changed = false
+  let result = html
+
+  // Process from innermost to outermost to avoid double-encryption
+  while (true) {
+    const matches = findEncryptionTemplates(result)
+    const pending = matches.filter(m =>
+      !hasNestedUnencryptedTemplate(m)
+      && !String(m.attrs).includes('data-cipher="aes-256-gcm-v2"')
+      && !String(m.attrs).includes('data-cipher="aes-256-gcm-v1"'),
+    )
+
+    if (pending.length === 0)
+      break
+
+    // Process in reverse order to preserve positions
+    for (let i = pending.length - 1; i >= 0; i--) {
+      const match = pending[i]
+      const attrs = String(match.attrs)
+
+      const passwordMatch = attrs.match(/\bdata-password\s*=\s*(?:"([^"]+)"|'([^']+)'|([^\s>]+))/)
+      if (!passwordMatch)
+        continue
+
+      const passwordHash = passwordMatch[1] || passwordMatch[2] || passwordMatch[3]
+      if (!passwordHash)
+        continue
+
+      // Replace raw SHA-256 hash with PBKDF2 verification hash
+      const { hash: verifyHash, salt: verifySalt } = deriveVerificationHash(passwordHash)
+      const encryptedPayload = encryptPayload(match.content, passwordHash)
+      const replacedAttrs = attrs.replace(/\bdata-password\s*=\s*(?:"[^"]+"|'[^']+'|[^\s>]+)/, `data-password="${verifyHash}"`)
+      const newAttrs = `${replacedAttrs} data-verify-salt="${verifySalt.toString('base64')}" data-cipher="${AES_MARKER}"`
+      const newBlock = `<template${newAttrs}>${encryptedPayload}</template>`
+
+      result = result.slice(0, match.openStart) + newBlock + result.slice(match.closeEnd)
+      changed = true
+    }
+  }
+
+  return { content: result, changed }
+}
+
+function hasUnencryptedTemplate(matches: TemplateMatch[]): boolean {
+  return matches.some((match) => {
+    const attrs = String(match.attrs)
+    const hasAesMarker = /\bdata-cipher\s*=\s*"aes-256-gcm-v[12]"/.test(attrs)
+    return !hasAesMarker
+  })
+}
+
+function main() {
+  const options = parseArgs(process.argv.slice(2))
+  const targetDir = path.isAbsolute(options.input)
+    ? options.input
+    : path.resolve(options.cwd, options.input)
+
+  let htmlFiles: string[] = []
+  try {
+    htmlFiles = collectHtmlFiles(targetDir)
+  }
+  catch (error) {
+    consola.error(`Failed to scan input directory: ${targetDir}`)
+    consola.error(error)
+    process.exit(1)
+  }
+
+  let changedFiles = 0
+  let unencryptedFiles = 0
+  let totalTemplates = 0
+  for (const filePath of htmlFiles) {
+    const originalContent = readFileSync(filePath, 'utf8')
+    const matches = findEncryptionTemplates(originalContent)
+    totalTemplates += matches.length
+
+    if (hasUnencryptedTemplate(matches)) {
+      unencryptedFiles++
+      if (options.verifyOnly) {
+        consola.warn(`Unencrypted template found in: ${path.relative(options.cwd, filePath)}`)
+        continue
+      }
+    }
+
+    if (options.verifyOnly)
+      continue
+
+    const { content, changed } = encryptTemplatesInHtml(originalContent)
+    if (!changed)
+      continue
+
+    changedFiles++
+    if (!options.dryRun) {
+      writeFileSync(filePath, content, 'utf8')
+    }
+  }
+
+  if (options.verifyOnly) {
+    if (unencryptedFiles > 0) {
+      consola.warn(`Verification failed: ${unencryptedFiles} HTML files still contain unencrypted templates`)
+      process.exit(1)
+    }
+    if (totalTemplates === 0) {
+      consola.info('No encryption templates found.')
+    }
+    else {
+      consola.info(`Verification passed: all ${totalTemplates} encryption templates use ${AES_MARKER}`)
+    }
+    return
+  }
+
+  if (changedFiles === 0) {
+    consola.info('No encryption templates found or all already encrypted.')
+    return
+  }
+
+  if (options.dryRun) {
+    consola.info(`Dry run complete: ${changedFiles} HTML files would be updated (${AES_MARKER})`)
+    return
+  }
+
+  consola.info(`Post-build encryption completed: ${changedFiles} HTML files updated (${AES_MARKER})`)
+}
+
+main()
diff --git a/packages/post-encrypt/tsconfig.json b/packages/post-encrypt/tsconfig.json
new file mode 100644
index 00000000..9e8486c7
--- /dev/null
+++ b/packages/post-encrypt/tsconfig.json
@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "rootDir": "src",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "types": ["node"],
+    "strict": true,
+    "declaration": true,
+    "outDir": "dist",
+    "skipLibCheck": true
+  },
+  "include": ["src/**/*.ts"]
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f5df3ea1..51edaa16 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -79,6 +79,12 @@ importers:
         specifier: ^11.3.6
         version: 11.3.6
 
+  packages/post-encrypt:
+    dependencies:
+      consola:
+        specifier: ^3.4.2
+        version: 3.4.2
+
   packages/shared:
     dependencies:
       consola: