diff --git a/docs/IMPLEMENTATION_PLAN_ISSUE143.md b/docs/IMPLEMENTATION_PLAN_ISSUE143.md
new file mode 100644
index 0000000..8d7000b
--- /dev/null
+++ b/docs/IMPLEMENTATION_PLAN_ISSUE143.md
@@ -0,0 +1,1060 @@
+<!--
+SPDX-FileCopyrightText: 2025 SecPal
+SPDX-License-Identifier: CC0-1.0
+-->
+
+# Implementation Plan: Client-Side File Encryption (Issue #143)
+
+**Issue:** SecPal/frontend#143
+**Epic:** SecPal/frontend#64 (PWA Infrastructure)
+**Priority:** High (Security-Critical)
+**Estimated Effort:** 1-2 weeks
+**Created:** 2025-11-19
+
+---
+
+## 📋 Executive Summary
+
+Implement end-to-end client-side file encryption for files shared via Share Target API before upload to backend, ensuring zero-knowledge architecture where the backend cannot decrypt file contents.
+
+---
+
+## ✅ Dependencies Status (All Green)
+
+- ✅ **#140** - Share Target POST method (Merged)
+- ✅ **#141** - Backend file upload API (Closed - COMPLETED)
+- ✅ **#142** - IndexedDB storage (Closed - COMPLETED)
+- ✅ **SecPal/api#174** - Secret Model + CRUD API (Merged)
+- ✅ **SecPal/api#175** - File Attachments API (Merged)
+
+**Status:** Ready to start implementation (19.11.2025)
+
+---
+
+## 🎯 Goals
+
+1. **End-to-End Encryption** - Files encrypted before leaving client
+2. **Zero-Knowledge Backend** - Server cannot decrypt file contents
+3. **Web Crypto API** - Use browser-native cryptography (AES-GCM 256-bit)
+4. **Secure Key Management** - Derive file keys from Secret's encryption key
+5. **Integrity Verification** - SHA-256 checksums before/after encryption
+6. **Test-Driven Development** - Follow TDD mandatory policy (≥80% coverage)
+
+---
+
+## 🔒 Security Requirements
+
+- ⚠️ **NEVER** log or expose encryption keys
+- ⚠️ Use secure key derivation (HKDF, not simple hash)
+- ⚠️ Verify file integrity (checksum before/after)
+- ⚠️ Handle key rotation carefully
+- ⚠️ Test against known encryption test vectors
+- ⚠️ Consider forward secrecy for future implementations
+
+---
+
+## 📐 Architecture Overview
+
+### Encryption Flow
+
+```text
+1. User shares file via Share Target API
+   → File stored in IndexedDB (unencrypted, temporary)
+
+2. User selects/creates Secret
+   → Derive file encryption key from Secret's master key
+
+3. Encrypt file client-side (Web Crypto API)
+   → File blob encrypted with AES-GCM-256
+   → Generate IV (12 bytes), auth tag (16 bytes)
+   → Calculate checksum (SHA-256)
+
+4. Upload encrypted blob + metadata to backend
+   → Backend stores encrypted file as-is (no decryption)
+   → Metadata (filename, size, type) encrypted separately
+
+5. Download: Fetch encrypted blob
+   → Decrypt client-side with Secret's key
+   → Verify checksum
+   → Display/download decrypted file
+```
+
+### Data Structures
+
+```typescript
+// Encrypted file format (stored in backend)
+interface EncryptedFileBlob {
+  version: 1;
+  algorithm: "AES-GCM-256";
+  iv: Uint8Array; // 12 bytes (Initialization Vector)
+  encryptedData: ArrayBuffer; // Encrypted file contents
+  authTag: Uint8Array; // 16 bytes (included in GCM)
+}
+
+// File metadata (encrypted separately with Secret's key)
+interface FileMetadata {
+  filename: string; // Encrypted with Secret's key
+  type: string; // MIME type (encrypted)
+  size: number; // Original size (before encryption)
+  encryptedSize: number; // Size after encryption
+  checksum: string; // SHA-256 of ORIGINAL file (hex)
+  checksumEncrypted: string; // SHA-256 of ENCRYPTED blob (hex)
+}
+
+// IndexedDB queue entry (extended)
+interface FileQueueEntry {
+  id: string;
+  file: Blob; // Original file (unencrypted, temporary)
+  encryptedBlob?: Blob; // Encrypted blob (after encryption)
+  metadata: FileMetadata;
+  uploadState:
+    | "pending"
+    | "encrypting"
+    | "encrypted"
+    | "uploading"
+    | "failed"
+    | "completed";
+  secretId?: string;
+  encryptionKey?: CryptoKey; // Derived from Secret (non-extractable)
+  retryCount: number;
+  error?: string;
+}
+```
+
+---
+
+## 🧪 TDD Implementation Plan (Phase-by-Phase)
+
+### **Phase 1: Crypto Utilities (Week 1, Days 1-2)**
+
+**Goal:** Implement core encryption/decryption functions with comprehensive tests.
+
+#### Step 1.1: Test Vectors Setup
+
+**File:** `src/lib/crypto/testVectors.ts`
+
+```typescript
+// Known-answer tests (KAT) for AES-GCM-256
+export const TEST_VECTORS = {
+  plaintext: new Uint8Array([72, 101, 108, 108, 111]), // "Hello"
+  key: new Uint8Array(32), // 32 bytes of zeros
+  iv: new Uint8Array(12),  // 12 bytes of zeros
+  expectedCiphertext: new Uint8Array([...]), // Known output
+  expectedAuthTag: new Uint8Array([...])     // Known auth tag
+};
+```
+
+#### Step 1.2: Write Tests FIRST (TDD)
+
+**File:** `src/lib/crypto/encryption.test.ts`
+
+```typescript
+import { describe, it, expect } from "vitest";
+import { encryptFile, decryptFile, deriveFileKey } from "./encryption";
+import { TEST_VECTORS } from "./testVectors";
+
+describe("File Encryption", () => {
+  it("should encrypt file with AES-GCM-256", async () => {
+    const file = new File([TEST_VECTORS.plaintext], "test.txt");
+    const key = await crypto.subtle.importKey(
+      "raw",
+      TEST_VECTORS.key,
+      { name: "AES-GCM" },
+      false,
+      ["encrypt"]
+    );
+
+    const encrypted = await encryptFile(file, key);
+
+    expect(encrypted.version).toBe(1);
+    expect(encrypted.algorithm).toBe("AES-GCM-256");
+    expect(encrypted.iv.length).toBe(12);
+    expect(encrypted.encryptedData).toBeInstanceOf(ArrayBuffer);
+  });
+
+  it("should decrypt file correctly (roundtrip)", async () => {
+    const originalText = "Hello, SecPal!";
+    const file = new File([originalText], "test.txt");
+    const key = await generateTestKey();
+
+    const encrypted = await encryptFile(file, key);
+    const decrypted = await decryptFile(encrypted, key);
+
+    const decryptedText = await decrypted.text();
+    expect(decryptedText).toBe(originalText);
+    expect(decrypted.name).toBe("test.txt");
+  });
+
+  it("should fail to decrypt with wrong key", async () => {
+    const file = new File(["secret"], "test.txt");
+    const correctKey = await generateTestKey();
+    const wrongKey = await generateTestKey();
+
+    const encrypted = await encryptFile(file, correctKey);
+
+    await expect(decryptFile(encrypted, wrongKey)).rejects.toThrow();
+  });
+
+  it("should detect tampering (auth tag verification)", async () => {
+    const file = new File(["data"], "test.txt");
+    const key = await generateTestKey();
+
+    const encrypted = await encryptFile(file, key);
+
+    // Tamper with encrypted data
+    const tampered = new Uint8Array(encrypted.encryptedData);
+    tampered[0] ^= 1; // Flip one bit
+    encrypted.encryptedData = tampered.buffer;
+
+    await expect(decryptFile(encrypted, key)).rejects.toThrow();
+  });
+
+  it("should use known test vectors (NIST validation)", async () => {
+    const encrypted = await encryptWithTestVector(TEST_VECTORS);
+    expect(encrypted.encryptedData).toEqual(TEST_VECTORS.expectedCiphertext);
+  });
+});
+
+describe("Key Derivation", () => {
+  it("should derive file key from secret key using HKDF", async () => {
+    const secretKey = await generateTestKey();
+    const filename = "test.pdf";
+
+    const fileKey = await deriveFileKey(secretKey, filename);
+
+    expect(fileKey.type).toBe("secret");
+    expect(fileKey.extractable).toBe(false);
+    expect(fileKey.usages).toContain("encrypt");
+    expect(fileKey.usages).toContain("decrypt");
+  });
+
+  it("should derive different keys for different filenames", async () => {
+    const secretKey = await generateTestKey();
+
+    const key1 = await deriveFileKey(secretKey, "file1.txt");
+    const key2 = await deriveFileKey(secretKey, "file2.txt");
+
+    // Keys should be different (compare exports)
+    const exported1 = await crypto.subtle.exportKey("raw", key1);
+    const exported2 = await crypto.subtle.exportKey("raw", key2);
+    expect(exported1).not.toEqual(exported2);
+  });
+
+  it("should derive same key for same filename (deterministic)", async () => {
+    const secretKey = await generateTestKey();
+
+    const key1 = await deriveFileKey(secretKey, "test.pdf");
+    const key2 = await deriveFileKey(secretKey, "test.pdf");
+
+    const exported1 = await crypto.subtle.exportKey("raw", key1);
+    const exported2 = await crypto.subtle.exportKey("raw", key2);
+    expect(exported1).toEqual(exported2);
+  });
+});
+```
+
+#### Step 1.3: Implement Functions (Make Tests Pass)
+
+**File:** `src/lib/crypto/encryption.ts`
+
+```typescript
+/**
+ * Encrypt file using AES-GCM-256
+ * @param file - File to encrypt
+ * @param key - CryptoKey (AES-GCM, 256-bit)
+ * @returns Encrypted blob with metadata
+ */
+export async function encryptFile(
+  file: File,
+  key: CryptoKey
+): Promise<EncryptedFileBlob> {
+  // 1. Generate random IV (12 bytes for AES-GCM)
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+
+  // 2. Read file as ArrayBuffer
+  const data = await file.arrayBuffer();
+
+  // 3. Encrypt with AES-GCM (auth tag included in output)
+  const encryptedData = await crypto.subtle.encrypt(
+    {
+      name: "AES-GCM",
+      iv: iv,
+      tagLength: 128, // 16 bytes auth tag
+    },
+    key,
+    data
+  );
+
+  // 4. Extract auth tag (last 16 bytes)
+  const authTag = new Uint8Array(encryptedData.slice(-16));
+
+  return {
+    version: 1,
+    algorithm: "AES-GCM-256",
+    iv: iv,
+    encryptedData: encryptedData,
+    authTag: authTag,
+  };
+}
+
+/**
+ * Decrypt encrypted file blob
+ * @param blob - Encrypted blob
+ * @param key - CryptoKey (same as encryption)
+ * @returns Decrypted File object
+ */
+export async function decryptFile(
+  blob: EncryptedFileBlob,
+  key: CryptoKey
+): Promise<File> {
+  // 1. Verify version and algorithm
+  if (blob.version !== 1 || blob.algorithm !== "AES-GCM-256") {
+    throw new Error("Unsupported encryption format");
+  }
+
+  // 2. Decrypt with AES-GCM (auth tag verification automatic)
+  try {
+    const decryptedData = await crypto.subtle.decrypt(
+      {
+        name: "AES-GCM",
+        iv: blob.iv,
+        tagLength: 128,
+      },
+      key,
+      blob.encryptedData
+    );
+
+    // 3. Return as File object
+    return new File([decryptedData], "decrypted.bin");
+  } catch (error) {
+    throw new Error("Decryption failed (wrong key or tampered data)");
+  }
+}
+
+/**
+ * Derive file encryption key from secret master key using HKDF
+ * @param secretKey - Secret's master key
+ * @param filename - Filename (used as salt for key derivation)
+ * @returns Derived CryptoKey for file encryption
+ */
+export async function deriveFileKey(
+  secretKey: CryptoKey,
+  filename: string
+): Promise<CryptoKey> {
+  // 1. Hash filename to create salt
+  const salt = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(filename)
+  );
+
+  // 2. Derive key using HKDF (HMAC-based Extract-and-Expand)
+  const derivedBits = await crypto.subtle.deriveBits(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: salt,
+      info: new TextEncoder().encode("file-encryption"),
+    },
+    secretKey,
+    256 // 256 bits = 32 bytes for AES-256
+  );
+
+  // 3. Import as AES-GCM key
+  return crypto.subtle.importKey(
+    "raw",
+    derivedBits,
+    { name: "AES-GCM" },
+    false, // Non-extractable (never leaves secure storage)
+    ["encrypt", "decrypt"]
+  );
+}
+```
+
+#### Step 1.4: Checksum Utilities (Tests First)
+
+**File:** `src/lib/crypto/checksum.test.ts`
+
+```typescript
+describe("File Checksum", () => {
+  it("should calculate SHA-256 checksum of file", async () => {
+    const file = new File(["Hello"], "test.txt");
+    const checksum = await calculateChecksum(file);
+
+    expect(checksum).toBe(
+      "185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969"
+    );
+  });
+
+  it("should detect file modifications", async () => {
+    const file1 = new File(["data"], "test.txt");
+    const file2 = new File(["data2"], "test.txt");
+
+    const checksum1 = await calculateChecksum(file1);
+    const checksum2 = await calculateChecksum(file2);
+
+    expect(checksum1).not.toBe(checksum2);
+  });
+
+  it("should verify checksum correctly", async () => {
+    const file = new File(["test"], "test.txt");
+    const checksum = await calculateChecksum(file);
+
+    expect(await verifyChecksum(file, checksum)).toBe(true);
+    expect(await verifyChecksum(file, "wrong-checksum")).toBe(false);
+  });
+});
+```
+
+**File:** `src/lib/crypto/checksum.ts`
+
+```typescript
+/**
+ * Calculate SHA-256 checksum of file
+ * @param file - File or Blob to hash
+ * @returns Hex-encoded checksum
+ */
+export async function calculateChecksum(file: File | Blob): Promise<string> {
+  const data = await file.arrayBuffer();
+  const hash = await crypto.subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(hash))
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+/**
+ * Verify file checksum
+ * @param file - File to verify
+ * @param expectedChecksum - Expected checksum (hex)
+ * @returns True if checksum matches
+ */
+export async function verifyChecksum(
+  file: File | Blob,
+  expectedChecksum: string
+): Promise<boolean> {
+  const actualChecksum = await calculateChecksum(file);
+  return actualChecksum === expectedChecksum;
+}
+```
+
+**Acceptance Criteria Phase 1:**
+
+- ✅ All tests passing (≥15 tests)
+- ✅ Known test vectors validated
+- ✅ Roundtrip encryption/decryption works
+- ✅ Tampering detection works
+- ✅ Key derivation deterministic
+- ✅ Checksum verification works
+- ✅ Code coverage ≥80%
+
+---
+
+### **Phase 2: ShareTarget Integration (Week 1, Days 3-4)**
+
+**Goal:** Integrate encryption into Share Target flow with progress indicators.
+
+#### Step 2.1: Write Integration Tests FIRST
+
+**File:** `src/pages/ShareTarget.test.tsx` (extend existing)
+
+```typescript
+describe('ShareTarget - File Encryption', () => {
+  it('should encrypt files before adding to IndexedDB queue', async () => {
+    const mockFile = new File(['secret data'], 'confidential.pdf');
+    const mockSecretKey = await generateTestKey();
+
+    render(<ShareTarget />);
+
+    // Simulate file share
+    await shareFiles([mockFile]);
+
+    // Select secret
+    const secretSelector = screen.getByLabelText('Select Secret');
+    fireEvent.change(secretSelector, { target: { value: 'secret-123' } });
+
+    // Click "Encrypt & Save"
+    const saveButton = screen.getByRole('button', { name: /encrypt & save/i });
+    fireEvent.click(saveButton);
+
+    // Wait for encryption
+    await waitFor(() => {
+      expect(screen.getByText(/encrypted/i)).toBeInTheDocument();
+    });
+
+    // Verify file in IndexedDB is encrypted
+    const queueEntry = await fileQueueDB.get(mockFile.name);
+    expect(queueEntry.encryptedBlob).toBeDefined();
+    expect(queueEntry.uploadState).toBe('encrypted');
+  });
+
+  it('should show encryption progress indicator', async () => {
+    const largeFile = createMockFile(5 * 1024 * 1024); // 5MB
+
+    render(<ShareTarget />);
+    await shareFiles([largeFile]);
+
+    const saveButton = screen.getByRole('button', { name: /encrypt & save/i });
+    fireEvent.click(saveButton);
+
+    // Progress indicator should appear
+    expect(screen.getByRole('progressbar')).toBeInTheDocument();
+    expect(screen.getByText(/encrypting/i)).toBeInTheDocument();
+  });
+
+  it('should handle encryption errors gracefully', async () => {
+    const mockFile = new File(['data'], 'test.txt');
+
+    // Mock encryption failure
+    vi.spyOn(crypto.subtle, 'encrypt').mockRejectedValue(new Error('Crypto not supported'));
+
+    render(<ShareTarget />);
+    await shareFiles([mockFile]);
+
+    const saveButton = screen.getByRole('button', { name: /encrypt & save/i });
+    fireEvent.click(saveButton);
+
+    await waitFor(() => {
+      expect(screen.getByText(/encryption failed/i)).toBeInTheDocument();
+    });
+  });
+
+  it('should not expose encryption keys in console/errors', async () => {
+    const consoleSpy = vi.spyOn(console, 'log');
+    const mockFile = new File(['secret'], 'test.txt');
+
+    render(<ShareTarget />);
+    await shareFiles([mockFile]);
+
+    const saveButton = screen.getByRole('button', { name: /encrypt & save/i });
+    fireEvent.click(saveButton);
+
+    await waitFor(() => screen.getByText(/encrypted/i));
+
+    // Verify no keys logged
+    expect(consoleSpy).not.toHaveBeenCalledWith(expect.stringContaining('CryptoKey'));
+  });
+});
+```
+
+#### Step 2.2: Update ShareTarget Component
+
+**File:** `src/pages/ShareTarget.tsx`
+
+```typescript
+import { encryptFile, deriveFileKey } from '@/lib/crypto/encryption';
+import { calculateChecksum } from '@/lib/crypto/checksum';
+import { useFileQueue } from '@/hooks/useFileQueue';
+
+export function ShareTarget() {
+  const [selectedSecretId, setSelectedSecretId] = useState<string | null>(null);
+  const [encryptionProgress, setEncryptionProgress] = useState<Map<string, number>>(new Map());
+  const [encryptionErrors, setEncryptionErrors] = useState<Map<string, string>>(new Map());
+  const { addToQueue } = useFileQueue();
+
+  async function handleEncryptAndSave() {
+    if (!sharedData?.files || !selectedSecretId) return;
+
+    for (const file of sharedData.files) {
+      try {
+        setEncryptionProgress(prev => new Map(prev).set(file.name, 0));
+
+        // 1. Get Secret's master key (from Secret Management API)
+        const secretKey = await getSecretMasterKey(selectedSecretId);
+
+        // 2. Derive file-specific key
+        const fileKey = await deriveFileKey(secretKey, file.name);
+
+        setEncryptionProgress(prev => new Map(prev).set(file.name, 25));
+
+        // 3. Calculate original checksum
+        const originalChecksum = await calculateChecksum(file);
+
+        setEncryptionProgress(prev => new Map(prev).set(file.name, 50));
+
+        // 4. Encrypt file
+        const encryptedBlob = await encryptFile(file, fileKey);
+
+        setEncryptionProgress(prev => new Map(prev).set(file.name, 75));
+
+        // 5. Calculate encrypted checksum
+        const encryptedChecksum = await calculateChecksum(
+          new Blob([encryptedBlob.encryptedData])
+        );
+
+        // 6. Add to IndexedDB queue
+        await addToQueue({
+          id: crypto.randomUUID(),
+          file: file, // Original (will be deleted after upload)
+          encryptedBlob: new Blob([encryptedBlob.encryptedData]),
+          metadata: {
+            filename: file.name,
+            type: file.type,
+            size: file.size,
+            encryptedSize: encryptedBlob.encryptedData.byteLength,
+            checksum: originalChecksum,
+            checksumEncrypted: encryptedChecksum
+          },
+          uploadState: 'encrypted',
+          secretId: selectedSecretId,
+          encryptionKey: fileKey,
+          retryCount: 0
+        });
+
+        setEncryptionProgress(prev => new Map(prev).set(file.name, 100));
+      } catch (error) {
+        console.error('Encryption failed:', error);
+        setEncryptionErrors(prev =>
+          new Map(prev).set(file.name, error.message)
+        );
+      }
+    }
+  }
+
+  return (
+    <div>
+      {/* Existing file list UI */}
+
+      {/* Secret selector */}
+      <select onChange={(e) => setSelectedSecretId(e.target.value)}>
+        <option value="">Select Secret</option>
+        {/* Secret list from API */}
+      </select>
+
+      {/* Encrypt & Save button */}
+      <button onClick={handleEncryptAndSave}>
+        🔐 Encrypt & Save to Secret
+      </button>
+
+      {/* Progress indicators */}
+      {Array.from(encryptionProgress.entries()).map(([filename, progress]) => (
+        <div key={filename}>
+          <progress value={progress} max={100} />
+          <span>{filename}: {progress}%</span>
+        </div>
+      ))}
+
+      {/* Error display */}
+      {Array.from(encryptionErrors.entries()).map(([filename, error]) => (
+        <div key={filename} className="text-red-600">
+          ❌ {filename}: {error}
+        </div>
+      ))}
+    </div>
+  );
+}
+```
+
+**Acceptance Criteria Phase 2:**
+
+- ✅ Files encrypted before IndexedDB storage
+- ✅ Progress indicators work
+- ✅ Error handling graceful
+- ✅ No keys logged to console
+- ✅ All tests passing
+- ✅ Code coverage ≥80%
+
+---
+
+### **Phase 3: Upload Integration (Week 2, Days 1-2)**
+
+**Goal:** Upload encrypted blobs to backend with metadata.
+
+#### Step 3.1: Write Upload Tests FIRST
+
+**File:** `src/services/secretApi.test.ts`
+
+```typescript
+describe('Secret API - Encrypted File Upload', () => {
+  it('should upload encrypted blob to backend', async () => {
+    const encryptedBlob = new Blob([new Uint8Array([1, 2, 3])]);
+    const metadata = {
+      filename: 'test.pdf',
+      type: 'application/pdf',
+      size: 1024,
+      encryptedSize: 128,
+      checksum: 'abc123',
+      checksumEncrypted: 'def456'
+    };
+
+    const response = await uploadEncryptedAttachment('secret-123', encryptedBlob, metadata);
+
+    expect(response.data.id).toBeDefined();
+    expect(response.data.filename).toBe('test.pdf');
+  });
+
+  it('should include metadata in upload', async () => {
+    const mock = mockFetch();
+
+    await uploadEncryptedAttachment('secret-123', new Blob(), {...});
+
+    expect(mock).toHaveBeenCalledWith(
+      expect.stringContaining('/secrets/secret-123/attachments'),
+      expect.objectContaining({
+        method: 'POST',
+        body: expect.any(FormData)
+      })
+    );
+
+    const formData = mock.mock.calls[0][1].body;
+    expect(formData.get('metadata')).toContain('checksum');
+  });
+});
+```
+
+#### Step 3.2: Implement Upload Function
+
+**File:** `src/services/secretApi.ts`
+
+```typescript
+/**
+ * Upload encrypted file attachment to Secret
+ * @param secretId - Secret UUID
+ * @param encryptedBlob - Encrypted file blob
+ * @param metadata - File metadata (encrypted separately)
+ * @returns Upload response
+ */
+export async function uploadEncryptedAttachment(
+  secretId: string,
+  encryptedBlob: Blob,
+  metadata: FileMetadata
+): Promise<UploadResponse> {
+  const formData = new FormData();
+  formData.append("file", encryptedBlob, "encrypted.bin");
+  formData.append("metadata", JSON.stringify(metadata));
+
+  const response = await fetch(`/api/v1/secrets/${secretId}/attachments`, {
+    method: "POST",
+    headers: getAuthHeaders(), // No Content-Type for FormData
+    body: formData,
+  });
+
+  if (!response.ok) {
+    throw new Error(`Upload failed: ${response.statusText}`);
+  }
+
+  return response.json();
+}
+```
+
+**Acceptance Criteria Phase 3:**
+
+- ✅ Encrypted blobs uploaded to backend
+- ✅ Metadata included in upload
+- ✅ Upload errors handled
+- ✅ All tests passing
+- ✅ Code coverage ≥80%
+
+---
+
+### **Phase 4: Download & Decryption (Week 2, Days 3-4)**
+
+**Goal:** Download encrypted files and decrypt client-side for preview/download.
+
+#### Step 4.1: Write Decryption Tests FIRST
+
+**File:** `src/services/secretApi.test.ts` (extend)
+
+```typescript
+describe("Secret API - Encrypted File Download", () => {
+  it("should download and decrypt file", async () => {
+    const attachmentId = "attachment-123";
+    const secretKey = await generateTestKey();
+
+    const decryptedFile = await downloadAndDecryptAttachment(
+      attachmentId,
+      secretKey
+    );
+
+    expect(decryptedFile).toBeInstanceOf(File);
+    expect(decryptedFile.name).toBe("document.pdf");
+  });
+
+  it("should verify checksum after decryption", async () => {
+    const mockEncryptedBlob = createMockEncryptedBlob();
+    const secretKey = await generateTestKey();
+
+    const result = await downloadAndDecryptAttachment("id", secretKey);
+
+    expect(result.checksumValid).toBe(true);
+  });
+
+  it("should reject tampered files", async () => {
+    const tamperedBlob = createTamperedBlob();
+
+    await expect(downloadAndDecryptAttachment("id", secretKey)).rejects.toThrow(
+      "Checksum verification failed"
+    );
+  });
+});
+```
+
+#### Step 4.2: Implement Download & Decryption
+
+**File:** `src/services/secretApi.ts` (extend)
+
+```typescript
+/**
+ * Download and decrypt file attachment
+ * @param attachmentId - Attachment UUID
+ * @param secretKey - Secret's master key
+ * @returns Decrypted file
+ */
+export async function downloadAndDecryptAttachment(
+  attachmentId: string,
+  secretKey: CryptoKey
+): Promise<File> {
+  // 1. Download encrypted blob + metadata
+  const response = await fetch(`/api/v1/attachments/${attachmentId}/download`);
+  if (!response.ok) throw new Error("Download failed");
+
+  const { encryptedBlob, metadata } = await response.json();
+
+  // 2. Derive file key (same as encryption)
+  const fileKey = await deriveFileKey(secretKey, metadata.filename);
+
+  // 3. Decrypt blob
+  const decryptedFile = await decryptFile(encryptedBlob, fileKey);
+
+  // 4. Verify checksum
+  const checksum = await calculateChecksum(decryptedFile);
+  if (checksum !== metadata.checksum) {
+    throw new Error(
+      "Checksum verification failed (file corrupted or tampered)"
+    );
+  }
+
+  // 5. Restore original filename
+  return new File([decryptedFile], metadata.filename, { type: metadata.type });
+}
+```
+
+**Acceptance Criteria Phase 4:**
+
+- ✅ Encrypted files downloaded
+- ✅ Decryption works correctly
+- ✅ Checksum verification enforced
+- ✅ Tampering detected
+- ✅ All tests passing
+- ✅ Code coverage ≥80%
+
+---
+
+### **Phase 5: Security Audit & Documentation (Week 2, Day 5)**
+
+**Goal:** Security review, documentation, and final testing.
+
+#### Step 5.1: Security Checklist
+
+- [ ] **Key Management**
+  - [ ] Keys never logged or exposed
+  - [ ] Keys non-extractable (Web Crypto API)
+  - [ ] HKDF used for key derivation (not simple hash)
+  - [ ] Unique IV for each encryption operation
+
+- [ ] **Encryption**
+  - [ ] AES-GCM-256 with 128-bit auth tag
+  - [ ] Known test vectors validated
+  - [ ] Tampering detection works (auth tag)
+
+- [ ] **Integrity**
+  - [ ] SHA-256 checksums before/after encryption
+  - [ ] Checksum verification enforced on download
+  - [ ] File corruption detected
+
+- [ ] **Error Handling**
+  - [ ] Decryption failures handled gracefully
+  - [ ] User-friendly error messages (no key exposure)
+  - [ ] Network failures don't expose keys
+
+- [ ] **Testing**
+  - [ ] ≥80% code coverage
+  - [ ] Known test vectors pass
+  - [ ] Roundtrip encryption/decryption works
+  - [ ] Tampering detection works
+  - [ ] Edge cases covered (large files, network errors)
+
+#### Step 5.2: Documentation Updates
+
+**File:** `frontend/docs/CRYPTO_ARCHITECTURE.md` (NEW)
+
+````markdown
+# Client-Side Encryption Architecture
+
+## Overview
+
+SecPal implements end-to-end encryption for file attachments using Web Crypto API with AES-GCM-256.
+
+## Key Hierarchy
+
+```text
+User Master Key (from authentication)
+└─> Secret Master Key (per Secret)
+└─> File Encryption Key (derived via HKDF + filename salt)
+```
+````
+
+### Encryption Workflow
+
+1. User shares file via Share Target API
+2. Derive file key from Secret's master key (HKDF)
+3. Encrypt file with AES-GCM-256 (random IV)
+4. Calculate checksums (before/after)
+5. Upload encrypted blob to backend
+6. Backend stores encrypted file (cannot decrypt)
+
+### Security Guarantees
+
+- **Zero-Knowledge Backend**: Server cannot decrypt files
+- **End-to-End Encryption**: Only client can decrypt
+- **Integrity Verification**: SHA-256 checksums + GCM auth tag
+- **Tampering Detection**: Modified files rejected
+- **Forward Secrecy**: Unique IV per encryption
+
+### API Reference
+
+See `src/lib/crypto/encryption.ts` for implementation details.
+
+```text
+Example Usage:
+const masterKey = await generateMasterKey();
+const fileKey = await deriveFileKey(masterKey, "document.pdf");
+const encrypted = await encryptFile(file, fileKey);
+```
+
+**Update:** `frontend/README.md` (add encryption section)
+**Update:** `frontend/CHANGELOG.md` (add Phase 3 encryption feature)
+
+**Acceptance Criteria Phase 5:**
+
+- ✅ Security checklist complete
+- ✅ Documentation comprehensive
+- ✅ CHANGELOG updated
+- ✅ README updated
+- ✅ No security vulnerabilities found
+
+---
+
+## 📦 Deliverables Checklist
+
+### Code
+
+- [ ] `src/lib/crypto/encryption.ts` (AES-GCM implementation)
+- [ ] `src/lib/crypto/encryption.test.ts` (≥15 tests)
+- [ ] `src/lib/crypto/checksum.ts` (SHA-256 utilities)
+- [ ] `src/lib/crypto/checksum.test.ts` (≥5 tests)
+- [ ] `src/lib/crypto/testVectors.ts` (known-answer tests)
+- [ ] `src/pages/ShareTarget.tsx` (encryption integration)
+- [ ] `src/pages/ShareTarget.test.tsx` (≥10 new tests)
+- [ ] `src/services/secretApi.ts` (upload/download functions)
+- [ ] `src/services/secretApi.test.ts` (≥8 tests)
+- [ ] `src/hooks/useFileQueue.ts` (IndexedDB integration)
+
+### Documentation
+
+- [ ] `docs/CRYPTO_ARCHITECTURE.md` (NEW)
+- [ ] `README.md` (encryption section)
+- [ ] `CHANGELOG.md` (Phase 3 encryption feature)
+- [ ] `PWA_PHASE3_TESTING.md` (encryption test scenarios)
+
+### Tests
+
+- [ ] **Total Tests:** ≥38 new tests (encryption + integration)
+- [ ] **Coverage:** ≥80% for all crypto code
+- [ ] **Security Tests:** ≥7 tests (key exposure, tampering, etc.)
+- [ ] **Test Vectors:** NIST-validated known-answer tests
+
+### Quality Gates
+
+- [ ] All tests passing (Vitest)
+- [ ] TypeScript strict mode clean
+- [ ] ESLint clean (no warnings)
+- [ ] Prettier formatted
+- [ ] REUSE compliant (SPDX headers)
+- [ ] Domain policy compliant (secpal.app/secpal.dev)
+- [ ] PHPStan/CodeQL passing (if applicable)
+- [ ] 4-Pass Self-Review completed
+
+---
+
+## 🚀 Branch Strategy
+
+```bash
+# Create feature branch
+git checkout main
+git pull
+git checkout -b feat/client-side-file-encryption
+
+# Follow TDD cycle for each phase
+# 1. Write tests FIRST
+# 2. Implement code (make tests pass)
+# 3. Refactor (keep tests green)
+# 4. Commit with signed commits
+
+# Example commit messages
+git commit -S -m "test: add encryption test vectors (Phase 1.1)"
+git commit -S -m "feat: implement AES-GCM file encryption (Phase 1.3)"
+git commit -S -m "test: add ShareTarget encryption integration tests (Phase 2.1)"
+git commit -S -m "feat: integrate encryption into ShareTarget (Phase 2.2)"
+
+# Create PR as DRAFT
+gh pr create --draft --title "feat: client-side file encryption (Issue #143)" \
+  --body "Closes #143\n\nPhase 1-5 complete (TDD)\n\nSee docs/IMPLEMENTATION_PLAN_ISSUE143.md"
+
+# After self-review (4-pass)
+gh pr ready
+```
+
+---
+
+## 📏 PR Rules
+
+- **Size Target:** ~800-1000 LOC (large PR justified - atomic encryption feature)
+- **One Topic:** File encryption only (no mixing with other features)
+- **Tests First:** TDD enforced (tests written before implementation)
+- **Coverage:** ≥80% for new code
+- **Self-Review:** 4-pass review BEFORE marking ready
+- **DRAFT → Ready:** Only after ZERO issues found locally
+
+---
+
+## ⚠️ Risk Mitigation
+
+### Risk 1: Web Crypto API Browser Support
+
+**Mitigation:** Check `crypto.subtle` availability, show error if not supported (HTTPS required)
+
+### Risk 2: Large File Performance
+
+**Mitigation:** Show progress indicator, consider chunked encryption for files >10MB (future)
+
+### Risk 3: Key Management Complexity
+
+**Mitigation:** Comprehensive tests, HKDF with deterministic derivation, non-extractable keys
+
+### Risk 4: Backend API Changes
+
+**Mitigation:** Backend API already stable (SecPal/api#175 merged), coordinate with backend team
+
+---
+
+## 📞 Support & Questions
+
+- **Backend Team:** Coordinate on encrypted file format if backend changes needed
+- **Security Review:** Request security audit before merging
+- **Performance:** Profile encryption with large files (5MB+)
+
+---
+
+## ✅ Success Metrics
+
+- [ ] **Zero-Knowledge:** Backend cannot decrypt files ✅
+- [ ] **Security:** CodeQL clean, no key exposure ✅
+- [ ] **Tests:** ≥38 new tests, ≥80% coverage ✅
+- [ ] **Performance:** <500ms encryption for 5MB file ✅
+- [ ] **UX:** Progress indicators work smoothly ✅
+- [ ] **Documentation:** Architecture documented ✅
+
+---
+
+**Plan Status:** Ready for implementation
+**Next Step:** Create branch `feat/client-side-file-encryption` and start Phase 1
+**Expected Completion:** 2025-12-03 (2 weeks)
diff --git a/src/lib/crypto/checksum.test.ts b/src/lib/crypto/checksum.test.ts
new file mode 100644
index 0000000..5ce863a
--- /dev/null
+++ b/src/lib/crypto/checksum.test.ts
@@ -0,0 +1,190 @@
+// SPDX-FileCopyrightText: 2025 SecPal
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import { describe, it, expect } from "vitest";
+import { calculateChecksum, verifyChecksum } from "./checksum";
+import { CHECKSUM_TEST_VECTORS } from "./testVectors";
+
+describe("SHA-256 Checksums", () => {
+  describe("calculateChecksum", () => {
+    it("should calculate SHA-256 checksum for empty input", async () => {
+      const testVector = CHECKSUM_TEST_VECTORS[0];
+      const checksum = await calculateChecksum(testVector.input);
+
+      expect(checksum).toBe(testVector.expectedChecksum);
+    });
+
+    it("should calculate SHA-256 checksum for simple text", async () => {
+      const testVector = CHECKSUM_TEST_VECTORS[1];
+      const checksum = await calculateChecksum(testVector.input);
+
+      expect(checksum).toBe(testVector.expectedChecksum);
+    });
+
+    it("should calculate SHA-256 checksum for binary data", async () => {
+      const testVector = CHECKSUM_TEST_VECTORS[2];
+      const checksum = await calculateChecksum(testVector.input);
+
+      expect(checksum).toBe(testVector.expectedChecksum);
+    });
+
+    it("should return lowercase hex string", async () => {
+      const data = new TextEncoder().encode("test");
+      const checksum = await calculateChecksum(data);
+
+      expect(checksum).toMatch(/^[0-9a-f]{64}$/); // 64 hex chars (256 bits)
+      expect(checksum).toBe(checksum.toLowerCase());
+    });
+
+    it("should produce consistent results for same input", async () => {
+      const data = new TextEncoder().encode("SecPal Test Data");
+
+      const checksum1 = await calculateChecksum(data);
+      const checksum2 = await calculateChecksum(data);
+
+      expect(checksum1).toBe(checksum2);
+    });
+
+    it("should produce different checksums for different inputs", async () => {
+      const data1 = new TextEncoder().encode("file1.pdf");
+      const data2 = new TextEncoder().encode("file2.pdf");
+
+      const checksum1 = await calculateChecksum(data1);
+      const checksum2 = await calculateChecksum(data2);
+
+      expect(checksum1).not.toBe(checksum2);
+    });
+
+    it("should handle large data (1MB)", async () => {
+      const largeData = new Uint8Array(1024 * 1024).fill(0x42);
+
+      const checksum = await calculateChecksum(largeData);
+
+      expect(checksum).toMatch(/^[0-9a-f]{64}$/);
+      expect(checksum.length).toBe(64); // 256 bits in hex
+    });
+  });
+
+  describe("verifyChecksum", () => {
+    it("should return true for matching checksums (empty input)", async () => {
+      const testVector = CHECKSUM_TEST_VECTORS[0];
+
+      const isValid = await verifyChecksum(
+        testVector.input,
+        testVector.expectedChecksum
+      );
+
+      expect(isValid).toBe(true);
+    });
+
+    it("should return true for matching checksums (simple text)", async () => {
+      const testVector = CHECKSUM_TEST_VECTORS[1];
+
+      const isValid = await verifyChecksum(
+        testVector.input,
+        testVector.expectedChecksum
+      );
+
+      expect(isValid).toBe(true);
+    });
+
+    it("should return true for matching checksums (binary data)", async () => {
+      const testVector = CHECKSUM_TEST_VECTORS[2];
+
+      const isValid = await verifyChecksum(
+        testVector.input,
+        testVector.expectedChecksum
+      );
+
+      expect(isValid).toBe(true);
+    });
+
+    it("should return false for mismatched checksums", async () => {
+      const data = new TextEncoder().encode("test data");
+      const wrongChecksum = "a".repeat(64); // Invalid checksum
+
+      const isValid = await verifyChecksum(data, wrongChecksum);
+
+      expect(isValid).toBe(false);
+    });
+
+    it("should return false if data is tampered", async () => {
+      const originalData = new TextEncoder().encode("original data");
+      const expectedChecksum = await calculateChecksum(originalData);
+
+      const tamperedData = new TextEncoder().encode("tampered data");
+      const isValid = await verifyChecksum(tamperedData, expectedChecksum);
+
+      expect(isValid).toBe(false);
+    });
+
+    it("should handle uppercase and lowercase checksums", async () => {
+      const data = new TextEncoder().encode("test");
+      const checksum = await calculateChecksum(data);
+
+      const uppercaseChecksum = checksum.toUpperCase();
+
+      const isValidLower = await verifyChecksum(data, checksum);
+      const isValidUpper = await verifyChecksum(data, uppercaseChecksum);
+
+      expect(isValidLower).toBe(true);
+      expect(isValidUpper).toBe(true);
+    });
+
+    it("should reject invalid checksum format", async () => {
+      const data = new TextEncoder().encode("test");
+
+      // Too short
+      const tooShort = "abc123";
+      const validShort = await verifyChecksum(data, tooShort);
+      expect(validShort).toBe(false);
+
+      // Invalid characters
+      const invalidChars = "z".repeat(64);
+      const validChars = await verifyChecksum(data, invalidChars);
+      expect(validChars).toBe(false);
+    });
+
+    it("should verify large data (1MB)", async () => {
+      const largeData = new Uint8Array(1024 * 1024).fill(0x42);
+      const checksum = await calculateChecksum(largeData);
+
+      const isValid = await verifyChecksum(largeData, checksum);
+
+      expect(isValid).toBe(true);
+    });
+  });
+
+  describe("Integration tests", () => {
+    it("should verify freshly calculated checksums", async () => {
+      const testData = [
+        new TextEncoder().encode("file1.pdf"),
+        new TextEncoder().encode("image.jpg"),
+        new Uint8Array([0x00, 0x01, 0x02, 0x03]),
+        new Uint8Array(1024).fill(0xff),
+      ];
+
+      for (const data of testData) {
+        const checksum = await calculateChecksum(data);
+        const isValid = await verifyChecksum(data, checksum);
+
+        expect(isValid).toBe(true);
+      }
+    });
+
+    it("should detect single-bit tampering", async () => {
+      const originalData = new Uint8Array([0x00, 0x01, 0x02, 0x03, 0x04]);
+      const checksum = await calculateChecksum(originalData);
+
+      // Flip one bit
+      const tamperedData = new Uint8Array(originalData);
+      if (tamperedData.length > 2 && tamperedData[2] !== undefined) {
+        tamperedData[2] ^= 0x01; // Flip bit in 3rd byte
+      }
+
+      const isValid = await verifyChecksum(tamperedData, checksum);
+
+      expect(isValid).toBe(false);
+    });
+  });
+});
diff --git a/src/lib/crypto/checksum.ts b/src/lib/crypto/checksum.ts
new file mode 100644
index 0000000..a1874fe
--- /dev/null
+++ b/src/lib/crypto/checksum.ts
@@ -0,0 +1,62 @@
+// SPDX-FileCopyrightText: 2025 SecPal
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+/**
+ * SHA-256 Checksum Module
+ *
+ * Provides file integrity verification using SHA-256 checksums.
+ * Checksums are calculated on:
+ * - Original plaintext (before encryption)
+ * - Encrypted ciphertext (after encryption)
+ *
+ * This allows verification of:
+ * - Plaintext integrity before encryption
+ * - Ciphertext integrity during transit/storage
+ * - Decrypted plaintext integrity after decryption
+ *
+ * @module lib/crypto/checksum
+ */
+
+/**
+ * Calculate SHA-256 checksum of data
+ *
+ * @param data - Binary data to hash
+ * @returns Promise resolving to hex-encoded SHA-256 checksum (64 characters)
+ * @throws {Error} If hashing fails
+ */
+export async function calculateChecksum(data: Uint8Array): Promise<string> {
+  const hashBuffer = await crypto.subtle.digest(
+    "SHA-256",
+    data as BufferSource
+  );
+  const hashArray = new Uint8Array(hashBuffer);
+
+  // Convert to hex string
+  return Array.from(hashArray)
+    .map((byte) => byte.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+/**
+ * Verify data integrity by comparing checksums
+ *
+ * @param data - Binary data to verify
+ * @param expectedChecksum - Expected SHA-256 checksum (hex string, case-insensitive)
+ * @returns Promise resolving to true if checksums match, false otherwise
+ * @throws {Error} If checksum calculation fails
+ */
+export async function verifyChecksum(
+  data: Uint8Array,
+  expectedChecksum: string
+): Promise<boolean> {
+  // Validate checksum format (64 hex characters)
+  const checksumRegex = /^[0-9a-fA-F]{64}$/;
+  if (!checksumRegex.test(expectedChecksum)) {
+    return false;
+  }
+
+  const actualChecksum = await calculateChecksum(data);
+
+  // Case-insensitive comparison
+  return actualChecksum.toLowerCase() === expectedChecksum.toLowerCase();
+}
diff --git a/src/lib/crypto/encryption.test.ts b/src/lib/crypto/encryption.test.ts
new file mode 100644
index 0000000..487069a
--- /dev/null
+++ b/src/lib/crypto/encryption.test.ts
@@ -0,0 +1,443 @@
+// SPDX-FileCopyrightText: 2025 SecPal
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import { describe, it, expect, vi } from "vitest";
+import {
+  encryptFile,
+  decryptFile,
+  deriveFileKey,
+  generateMasterKey,
+  exportMasterKey,
+  importMasterKey,
+} from "./encryption";
+import {
+  SIMPLE_TEST_VECTOR,
+  EMPTY_TEST_VECTOR,
+  LARGE_TEST_VECTOR,
+  HKDF_TEST_VECTOR,
+} from "./testVectors";
+
+describe("AES-GCM-256 Encryption", () => {
+  describe("generateMasterKey", () => {
+    it("should generate a 256-bit master key", async () => {
+      const masterKey = await generateMasterKey();
+
+      expect(masterKey).toBeInstanceOf(CryptoKey);
+      expect(masterKey.type).toBe("secret");
+      expect(masterKey.algorithm.name).toBe("AES-GCM");
+      expect((masterKey.algorithm as AesKeyAlgorithm).length).toBe(256);
+      expect(masterKey.extractable).toBe(true);
+      expect(masterKey.usages).toContain("encrypt");
+      expect(masterKey.usages).toContain("decrypt");
+    });
+
+    it("should generate different keys each time", async () => {
+      const key1 = await generateMasterKey();
+      const key2 = await generateMasterKey();
+
+      const exported1 = await crypto.subtle.exportKey("raw", key1);
+      const exported2 = await crypto.subtle.exportKey("raw", key2);
+
+      expect(new Uint8Array(exported1)).not.toEqual(new Uint8Array(exported2));
+    });
+  });
+
+  describe("exportMasterKey / importMasterKey", () => {
+    it("should export and import master key correctly", async () => {
+      const originalKey = await generateMasterKey();
+      const exported = await exportMasterKey(originalKey);
+
+      expect(exported).toBeInstanceOf(Uint8Array);
+      expect(exported.length).toBe(32); // 256 bits
+
+      const imported = await importMasterKey(exported);
+
+      expect(imported).toBeInstanceOf(CryptoKey);
+      expect(imported.algorithm.name).toBe("AES-GCM");
+      expect((imported.algorithm as AesKeyAlgorithm).length).toBe(256);
+    });
+
+    it("should reject invalid key length", async () => {
+      const invalidKey = new Uint8Array(16); // Too short (128 bits)
+
+      await expect(importMasterKey(invalidKey)).rejects.toThrow(
+        "Invalid master key length"
+      );
+    });
+
+    it("should maintain key material through export/import cycle", async () => {
+      const originalKey = await generateMasterKey();
+      const exported = await exportMasterKey(originalKey);
+      const imported = await importMasterKey(exported);
+
+      const testData = new Uint8Array([1, 2, 3, 4, 5]);
+      const iv = crypto.getRandomValues(new Uint8Array(12));
+
+      const encrypted1 = await crypto.subtle.encrypt(
+        { name: "AES-GCM", iv },
+        originalKey,
+        testData
+      );
+
+      const encrypted2 = await crypto.subtle.encrypt(
+        { name: "AES-GCM", iv },
+        imported,
+        testData
+      );
+
+      expect(new Uint8Array(encrypted1)).toEqual(new Uint8Array(encrypted2));
+    });
+  });
+
+  describe("deriveFileKey", () => {
+    it("should derive a file-specific encryption key", async () => {
+      const masterKeyBuffer = HKDF_TEST_VECTOR.masterKey;
+      const masterKey = await importMasterKey(masterKeyBuffer);
+
+      const fileKey = await deriveFileKey(masterKey, "test-file.pdf");
+
+      expect(fileKey).toBeInstanceOf(CryptoKey);
+      expect(fileKey.type).toBe("secret");
+      expect(fileKey.algorithm.name).toBe("AES-GCM");
+      expect((fileKey.algorithm as AesKeyAlgorithm).length).toBe(256);
+    });
+
+    it("should derive different keys for different filenames", async () => {
+      const masterKeyBuffer = HKDF_TEST_VECTOR.masterKey;
+      const masterKey = await importMasterKey(masterKeyBuffer);
+
+      const keys = await Promise.all(
+        HKDF_TEST_VECTOR.filenames.map((filename) =>
+          deriveFileKey(masterKey, filename)
+        )
+      );
+
+      // Cannot export non-extractable keys, so verify by encrypting same data
+      const testData = new Uint8Array([1, 2, 3, 4, 5]);
+      const fixedIV = new Uint8Array(12).fill(0x42);
+
+      const encrypted = await Promise.all(
+        keys.map((key) =>
+          crypto.subtle.encrypt({ name: "AES-GCM", iv: fixedIV }, key, testData)
+        )
+      );
+
+      // All ciphertexts should be different (different keys)
+      const cipher0 = encrypted[0];
+      const cipher1 = encrypted[1];
+      const cipher2 = encrypted[2];
+
+      if (cipher0 && cipher1 && cipher2) {
+        expect(new Uint8Array(cipher0)).not.toEqual(new Uint8Array(cipher1));
+        expect(new Uint8Array(cipher1)).not.toEqual(new Uint8Array(cipher2));
+        expect(new Uint8Array(cipher0)).not.toEqual(new Uint8Array(cipher2));
+      }
+    });
+    it("should derive same key for same filename (deterministic)", async () => {
+      const masterKeyBuffer = HKDF_TEST_VECTOR.masterKey;
+      const masterKey = await importMasterKey(masterKeyBuffer);
+
+      const key1 = await deriveFileKey(masterKey, "test-file.pdf");
+      const key2 = await deriveFileKey(masterKey, "test-file.pdf");
+
+      // Cannot export non-extractable keys, verify by encrypting same data
+      const testData = new Uint8Array([1, 2, 3, 4, 5]);
+      const fixedIV = new Uint8Array(12).fill(0x42);
+
+      const encrypted1 = await crypto.subtle.encrypt(
+        { name: "AES-GCM", iv: fixedIV },
+        key1,
+        testData
+      );
+      const encrypted2 = await crypto.subtle.encrypt(
+        { name: "AES-GCM", iv: fixedIV },
+        key2,
+        testData
+      );
+
+      // Same key should produce same ciphertext with same IV
+      expect(new Uint8Array(encrypted1)).toEqual(new Uint8Array(encrypted2));
+    });
+  });
+
+  describe("encryptFile", () => {
+    it("should encrypt simple plaintext", async () => {
+      const key = await importMasterKey(SIMPLE_TEST_VECTOR.key);
+      const fileKey = await deriveFileKey(key, "test.txt");
+
+      const result = await encryptFile(SIMPLE_TEST_VECTOR.plaintext, fileKey);
+
+      expect(result).toHaveProperty("ciphertext");
+      expect(result).toHaveProperty("iv");
+      expect(result).toHaveProperty("authTag");
+
+      expect(result.ciphertext).toBeInstanceOf(Uint8Array);
+      expect(result.iv).toBeInstanceOf(Uint8Array);
+      expect(result.authTag).toBeInstanceOf(Uint8Array);
+
+      expect(result.iv.length).toBe(12); // 96 bits
+      expect(result.authTag.length).toBe(16); // 128 bits
+    });
+
+    it("should handle empty plaintext", async () => {
+      const key = await importMasterKey(EMPTY_TEST_VECTOR.key);
+      const fileKey = await deriveFileKey(key, "empty.txt");
+
+      const result = await encryptFile(EMPTY_TEST_VECTOR.plaintext, fileKey);
+
+      expect(result.ciphertext.length).toBe(0);
+      expect(result.iv.length).toBe(12);
+      expect(result.authTag.length).toBe(16);
+    });
+
+    it("should handle large files (1KB)", async () => {
+      const key = await importMasterKey(LARGE_TEST_VECTOR.key);
+      const fileKey = await deriveFileKey(key, "large.bin");
+
+      const result = await encryptFile(LARGE_TEST_VECTOR.plaintext, fileKey);
+
+      expect(result.ciphertext.length).toBe(1024);
+      expect(result.iv.length).toBe(12);
+      expect(result.authTag.length).toBe(16);
+    });
+
+    it("should generate unique IV for each encryption", async () => {
+      const key = await importMasterKey(SIMPLE_TEST_VECTOR.key);
+      const fileKey = await deriveFileKey(key, "test.txt");
+
+      const result1 = await encryptFile(SIMPLE_TEST_VECTOR.plaintext, fileKey);
+      const result2 = await encryptFile(SIMPLE_TEST_VECTOR.plaintext, fileKey);
+
+      // IVs must be different
+      expect(result1.iv).not.toEqual(result2.iv);
+
+      // Ciphertexts should also be different (due to different IVs)
+      expect(result1.ciphertext).not.toEqual(result2.ciphertext);
+    });
+
+    it("should produce deterministic auth tag for same IV", async () => {
+      const key = await importMasterKey(SIMPLE_TEST_VECTOR.key);
+      const fileKey = await deriveFileKey(key, "test.txt");
+
+      // Mock crypto.getRandomValues to return same IV
+      const fixedIV = new Uint8Array(12).fill(0x42);
+      vi.spyOn(crypto, "getRandomValues").mockReturnValue(fixedIV);
+
+      const result1 = await encryptFile(SIMPLE_TEST_VECTOR.plaintext, fileKey);
+      const result2 = await encryptFile(SIMPLE_TEST_VECTOR.plaintext, fileKey);
+
+      expect(result1.iv).toEqual(result2.iv);
+      expect(result1.ciphertext).toEqual(result2.ciphertext);
+      expect(result1.authTag).toEqual(result2.authTag);
+
+      vi.restoreAllMocks();
+    });
+  });
+
+  describe("decryptFile", () => {
+    it("should decrypt encrypted data correctly", async () => {
+      const key = await importMasterKey(SIMPLE_TEST_VECTOR.key);
+      const fileKey = await deriveFileKey(key, "test.txt");
+
+      const encrypted = await encryptFile(
+        SIMPLE_TEST_VECTOR.plaintext,
+        fileKey
+      );
+
+      const decrypted = await decryptFile(
+        encrypted.ciphertext,
+        fileKey,
+        encrypted.iv,
+        encrypted.authTag
+      );
+
+      expect(decrypted).toEqual(SIMPLE_TEST_VECTOR.plaintext);
+    });
+
+    it("should handle empty ciphertext", async () => {
+      const key = await importMasterKey(EMPTY_TEST_VECTOR.key);
+      const fileKey = await deriveFileKey(key, "empty.txt");
+
+      const encrypted = await encryptFile(EMPTY_TEST_VECTOR.plaintext, fileKey);
+
+      const decrypted = await decryptFile(
+        encrypted.ciphertext,
+        fileKey,
+        encrypted.iv,
+        encrypted.authTag
+      );
+
+      expect(decrypted).toEqual(EMPTY_TEST_VECTOR.plaintext);
+    });
+
+    it("should handle large files (1KB)", async () => {
+      const key = await importMasterKey(LARGE_TEST_VECTOR.key);
+      const fileKey = await deriveFileKey(key, "large.bin");
+
+      const encrypted = await encryptFile(LARGE_TEST_VECTOR.plaintext, fileKey);
+
+      const decrypted = await decryptFile(
+        encrypted.ciphertext,
+        fileKey,
+        encrypted.iv,
+        encrypted.authTag
+      );
+
+      expect(decrypted).toEqual(LARGE_TEST_VECTOR.plaintext);
+    });
+
+    it("should fail if auth tag is tampered", async () => {
+      const key = await importMasterKey(SIMPLE_TEST_VECTOR.key);
+      const fileKey = await deriveFileKey(key, "test.txt");
+
+      const encrypted = await encryptFile(
+        SIMPLE_TEST_VECTOR.plaintext,
+        fileKey
+      );
+
+      // Tamper with auth tag
+      const tamperedAuthTag = new Uint8Array(encrypted.authTag);
+      if (tamperedAuthTag[0] !== undefined) tamperedAuthTag[0] ^= 0x01; // Flip one bit
+
+      await expect(
+        decryptFile(
+          encrypted.ciphertext,
+          fileKey,
+          encrypted.iv,
+          tamperedAuthTag
+        )
+      ).rejects.toThrow();
+    });
+
+    it("should fail if ciphertext is tampered", async () => {
+      const key = await importMasterKey(SIMPLE_TEST_VECTOR.key);
+      const fileKey = await deriveFileKey(key, "test.txt");
+
+      const encrypted = await encryptFile(
+        SIMPLE_TEST_VECTOR.plaintext,
+        fileKey
+      );
+
+      // Tamper with ciphertext
+      const tamperedCiphertext = new Uint8Array(encrypted.ciphertext);
+      if (
+        tamperedCiphertext.length > 0 &&
+        tamperedCiphertext[0] !== undefined
+      ) {
+        tamperedCiphertext[0] ^= 0x01; // Flip one bit
+      }
+
+      await expect(
+        decryptFile(
+          tamperedCiphertext,
+          fileKey,
+          encrypted.iv,
+          encrypted.authTag
+        )
+      ).rejects.toThrow();
+    });
+
+    it("should fail with wrong decryption key", async () => {
+      const key1 = await importMasterKey(SIMPLE_TEST_VECTOR.key);
+      const fileKey1 = await deriveFileKey(key1, "test.txt");
+
+      const encrypted = await encryptFile(
+        SIMPLE_TEST_VECTOR.plaintext,
+        fileKey1
+      );
+
+      // Try to decrypt with different key
+      const key2 = await generateMasterKey();
+      const fileKey2 = await deriveFileKey(key2, "test.txt");
+
+      await expect(
+        decryptFile(
+          encrypted.ciphertext,
+          fileKey2,
+          encrypted.iv,
+          encrypted.authTag
+        )
+      ).rejects.toThrow();
+    });
+
+    it("should fail with wrong filename (different derived key)", async () => {
+      const masterKey = await importMasterKey(SIMPLE_TEST_VECTOR.key);
+      const fileKey1 = await deriveFileKey(masterKey, "file1.txt");
+
+      const encrypted = await encryptFile(
+        SIMPLE_TEST_VECTOR.plaintext,
+        fileKey1
+      );
+
+      // Try to decrypt with key derived from different filename
+      const fileKey2 = await deriveFileKey(masterKey, "file2.txt");
+
+      await expect(
+        decryptFile(
+          encrypted.ciphertext,
+          fileKey2,
+          encrypted.iv,
+          encrypted.authTag
+        )
+      ).rejects.toThrow();
+    });
+
+    it("should reject invalid IV length", async () => {
+      const key = await importMasterKey(SIMPLE_TEST_VECTOR.key);
+      const fileKey = await deriveFileKey(key, "test.txt");
+
+      const encrypted = await encryptFile(
+        SIMPLE_TEST_VECTOR.plaintext,
+        fileKey
+      );
+
+      const invalidIV = new Uint8Array(8); // Too short
+
+      await expect(
+        decryptFile(encrypted.ciphertext, fileKey, invalidIV, encrypted.authTag)
+      ).rejects.toThrow("Invalid IV length");
+    });
+
+    it("should reject invalid auth tag length", async () => {
+      const key = await importMasterKey(SIMPLE_TEST_VECTOR.key);
+      const fileKey = await deriveFileKey(key, "test.txt");
+
+      const encrypted = await encryptFile(
+        SIMPLE_TEST_VECTOR.plaintext,
+        fileKey
+      );
+
+      const invalidAuthTag = new Uint8Array(8); // Too short
+
+      await expect(
+        decryptFile(encrypted.ciphertext, fileKey, encrypted.iv, invalidAuthTag)
+      ).rejects.toThrow("Invalid auth tag length");
+    });
+  });
+
+  describe("Round-trip encryption/decryption", () => {
+    it("should maintain data integrity through encrypt/decrypt cycle", async () => {
+      const testCases = [
+        { name: "simple", data: SIMPLE_TEST_VECTOR.plaintext },
+        { name: "empty", data: EMPTY_TEST_VECTOR.plaintext },
+        { name: "large", data: LARGE_TEST_VECTOR.plaintext },
+      ];
+
+      for (const testCase of testCases) {
+        const masterKey = await generateMasterKey();
+        const fileKey = await deriveFileKey(masterKey, `${testCase.name}.bin`);
+
+        const encrypted = await encryptFile(testCase.data, fileKey);
+
+        const decrypted = await decryptFile(
+          encrypted.ciphertext,
+          fileKey,
+          encrypted.iv,
+          encrypted.authTag
+        );
+
+        expect(decrypted).toEqual(testCase.data);
+      }
+    });
+  });
+});
diff --git a/src/lib/crypto/encryption.ts b/src/lib/crypto/encryption.ts
new file mode 100644
index 0000000..cf25ed9
--- /dev/null
+++ b/src/lib/crypto/encryption.ts
@@ -0,0 +1,223 @@
+// SPDX-FileCopyrightText: 2025 SecPal
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+/**
+ * AES-GCM-256 File Encryption Module
+ *
+ * This module provides zero-knowledge client-side file encryption using:
+ * - AES-GCM-256 for authenticated encryption
+ * - HKDF-SHA-256 for file-specific key derivation
+ * - Web Crypto API for all cryptographic operations
+ *
+ * @module lib/crypto/encryption
+ */
+
+/**
+ * Encrypted file result containing ciphertext, IV, and authentication tag
+ */
+export interface EncryptedFile {
+  /** Encrypted file data */
+  ciphertext: Uint8Array;
+  /** Initialization vector (96 bits / 12 bytes) */
+  iv: Uint8Array;
+  /** Authentication tag (128 bits / 16 bytes) */
+  authTag: Uint8Array;
+}
+
+/**
+ * Generate a new 256-bit AES-GCM master key
+ *
+ * @returns Promise resolving to CryptoKey (extractable, usages: encrypt, decrypt)
+ * @throws {Error} If key generation fails
+ */
+export async function generateMasterKey(): Promise<CryptoKey> {
+  return await crypto.subtle.generateKey(
+    {
+      name: "AES-GCM",
+      length: 256, // 256-bit key
+    },
+    true, // extractable (needed for export/storage)
+    ["encrypt", "decrypt"]
+  );
+}
+
+/**
+ * Export master key as raw bytes for storage
+ *
+ * @param masterKey - CryptoKey to export
+ * @returns Promise resolving to 32-byte Uint8Array
+ * @throws {Error} If key export fails or key is not extractable
+ */
+export async function exportMasterKey(
+  masterKey: CryptoKey
+): Promise<Uint8Array> {
+  const exported = await crypto.subtle.exportKey("raw", masterKey);
+  return new Uint8Array(exported);
+}
+
+/**
+ * Import raw master key bytes as CryptoKey
+ *
+ * @param keyBytes - 32-byte Uint8Array containing raw key material
+ * @returns Promise resolving to CryptoKey (extractable, usages: encrypt, decrypt)
+ * @throws {Error} If key import fails or key length is invalid
+ */
+export async function importMasterKey(
+  keyBytes: Uint8Array
+): Promise<CryptoKey> {
+  if (keyBytes.length !== 32) {
+    throw new Error(
+      `Invalid master key length: expected 32 bytes, got ${keyBytes.length}`
+    );
+  }
+
+  return await crypto.subtle.importKey(
+    "raw",
+    keyBytes as BufferSource,
+    {
+      name: "AES-GCM",
+      length: 256,
+    },
+    true, // extractable
+    ["encrypt", "decrypt"]
+  );
+}
+
+/**
+ * Derive a file-specific encryption key using HKDF-SHA-256
+ *
+ * Uses the filename as salt to ensure each file has a unique encryption key,
+ * preventing cross-file attacks even if master key is compromised.
+ *
+ * @param masterKey - Master encryption key
+ * @param filename - Original filename (used as salt for key derivation)
+ * @returns Promise resolving to derived CryptoKey
+ * @throws {Error} If key derivation fails
+ */
+export async function deriveFileKey(
+  masterKey: CryptoKey,
+  filename: string
+): Promise<CryptoKey> {
+  // Export master key to use as input key material
+  const masterKeyBytes = await crypto.subtle.exportKey("raw", masterKey);
+
+  // Import as HKDF base key
+  const hkdfKey = await crypto.subtle.importKey(
+    "raw",
+    masterKeyBytes,
+    "HKDF",
+    false, // not extractable
+    ["deriveKey"]
+  );
+
+  // Use filename as salt (encoded as UTF-8)
+  const salt = new TextEncoder().encode(filename);
+
+  // Derive file-specific AES-GCM key
+  return await crypto.subtle.deriveKey(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt,
+      info: new Uint8Array(0), // No additional info needed
+    },
+    hkdfKey,
+    {
+      name: "AES-GCM",
+      length: 256,
+    },
+    false, // not extractable (file keys are ephemeral)
+    ["encrypt", "decrypt"]
+  );
+}
+
+/**
+ * Encrypt a file using AES-GCM-256
+ *
+ * @param plaintext - File data to encrypt
+ * @param fileKey - File-specific encryption key (from deriveFileKey)
+ * @returns Promise resolving to EncryptedFile containing ciphertext, IV, and auth tag
+ * @throws {Error} If encryption fails
+ */
+export async function encryptFile(
+  plaintext: Uint8Array,
+  fileKey: CryptoKey
+): Promise<EncryptedFile> {
+  // Generate random IV (96 bits / 12 bytes)
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+
+  // Encrypt using AES-GCM
+  // tagLength: 128 bits (default, provides 128-bit authentication)
+  const encrypted = await crypto.subtle.encrypt(
+    {
+      name: "AES-GCM",
+      iv,
+      tagLength: 128, // 128-bit authentication tag
+    },
+    fileKey,
+    plaintext as BufferSource
+  );
+
+  // AES-GCM output contains ciphertext + auth tag concatenated
+  const encryptedArray = new Uint8Array(encrypted);
+  const authTagLength = 16; // 128 bits = 16 bytes
+
+  // Split ciphertext and auth tag
+  const ciphertext = encryptedArray.slice(
+    0,
+    encryptedArray.length - authTagLength
+  );
+  const authTag = encryptedArray.slice(encryptedArray.length - authTagLength);
+
+  return {
+    ciphertext,
+    iv,
+    authTag,
+  };
+}
+
+/**
+ * Decrypt a file using AES-GCM-256
+ *
+ * @param ciphertext - Encrypted file data
+ * @param fileKey - File-specific encryption key (from deriveFileKey)
+ * @param iv - Initialization vector (96 bits / 12 bytes)
+ * @param authTag - Authentication tag (128 bits / 16 bytes)
+ * @returns Promise resolving to decrypted plaintext
+ * @throws {Error} If decryption fails or authentication tag is invalid
+ */
+export async function decryptFile(
+  ciphertext: Uint8Array,
+  fileKey: CryptoKey,
+  iv: Uint8Array,
+  authTag: Uint8Array
+): Promise<Uint8Array> {
+  // Validate inputs
+  if (iv.length !== 12) {
+    throw new Error(`Invalid IV length: expected 12 bytes, got ${iv.length}`);
+  }
+  if (authTag.length !== 16) {
+    throw new Error(
+      `Invalid auth tag length: expected 16 bytes, got ${authTag.length}`
+    );
+  }
+
+  // Concatenate ciphertext and auth tag (Web Crypto API expects them together)
+  const combined = new Uint8Array(ciphertext.length + authTag.length);
+  combined.set(ciphertext, 0);
+  combined.set(authTag, ciphertext.length);
+
+  // Decrypt using AES-GCM
+  // Will throw if authentication fails (tampered data)
+  const decrypted = await crypto.subtle.decrypt(
+    {
+      name: "AES-GCM",
+      iv: iv as BufferSource,
+      tagLength: 128,
+    },
+    fileKey,
+    combined as BufferSource
+  );
+
+  return new Uint8Array(decrypted);
+}
diff --git a/src/lib/crypto/index.ts b/src/lib/crypto/index.ts
new file mode 100644
index 0000000..386107c
--- /dev/null
+++ b/src/lib/crypto/index.ts
@@ -0,0 +1,25 @@
+// SPDX-FileCopyrightText: 2025 SecPal
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+/**
+ * Crypto Module Public API
+ *
+ * This module provides zero-knowledge client-side file encryption
+ * and integrity verification for SecPal.
+ *
+ * @module lib/crypto
+ */
+
+// Encryption
+export {
+  generateMasterKey,
+  exportMasterKey,
+  importMasterKey,
+  deriveFileKey,
+  encryptFile,
+  decryptFile,
+} from "./encryption";
+export type { EncryptedFile } from "./encryption";
+
+// Checksums
+export { calculateChecksum, verifyChecksum } from "./checksum";
diff --git a/src/lib/crypto/testVectors.test.ts b/src/lib/crypto/testVectors.test.ts
new file mode 100644
index 0000000..a281298
--- /dev/null
+++ b/src/lib/crypto/testVectors.test.ts
@@ -0,0 +1,70 @@
+// SPDX-FileCopyrightText: 2025 SecPal
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import { describe, it, expect } from "vitest";
+import { toHex, fromHex } from "./testVectors";
+
+describe("Test Vector Helpers", () => {
+  describe("toHex", () => {
+    it("should convert Uint8Array to hex string", () => {
+      const input = new Uint8Array([0x00, 0x01, 0x02, 0xff]);
+      const result = toHex(input);
+
+      expect(result).toBe("000102ff");
+    });
+
+    it("should handle empty array", () => {
+      const input = new Uint8Array(0);
+      const result = toHex(input);
+
+      expect(result).toBe("");
+    });
+
+    it("should pad single digits with zero", () => {
+      const input = new Uint8Array([0x0a, 0x0b]);
+      const result = toHex(input);
+
+      expect(result).toBe("0a0b");
+    });
+  });
+
+  describe("fromHex", () => {
+    it("should convert hex string to Uint8Array", () => {
+      const input = "000102ff";
+      const result = fromHex(input);
+
+      expect(result).toEqual(new Uint8Array([0x00, 0x01, 0x02, 0xff]));
+    });
+
+    it("should handle empty string", () => {
+      const input = "";
+      const result = fromHex(input);
+
+      expect(result).toEqual(new Uint8Array(0));
+    });
+
+    it("should handle uppercase hex", () => {
+      const input = "ABCDEF";
+      const result = fromHex(input);
+
+      expect(result).toEqual(new Uint8Array([0xab, 0xcd, 0xef]));
+    });
+
+    it("should reject odd length hex strings", () => {
+      const input = "abc"; // Odd length
+
+      expect(() => fromHex(input)).toThrow("Invalid hex string (odd length)");
+    });
+  });
+
+  describe("Round-trip conversion", () => {
+    it("should maintain data through toHex/fromHex cycle", () => {
+      const original = new Uint8Array([0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc]);
+
+      const hex = toHex(original);
+      const restored = fromHex(hex);
+
+      expect(restored).toEqual(original);
+    });
+  });
+});
diff --git a/src/lib/crypto/testVectors.ts b/src/lib/crypto/testVectors.ts
new file mode 100644
index 0000000..b76a17d
--- /dev/null
+++ b/src/lib/crypto/testVectors.ts
@@ -0,0 +1,118 @@
+// SPDX-FileCopyrightText: 2025 SecPal
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+/**
+ * Known-Answer Tests (KAT) for AES-GCM-256 encryption
+ *
+ * These test vectors are used to validate that our implementation
+ * produces correct results according to NIST specifications.
+ *
+ * @see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program
+ */
+
+/**
+ * Simple test vector for basic functionality
+ * Uses all zeros for easy debugging
+ */
+export const SIMPLE_TEST_VECTOR = {
+  description: "Simple test vector (all zeros)",
+
+  // 256-bit key (all zeros)
+  key: new Uint8Array(32).fill(0),
+
+  // 96-bit IV (all zeros)
+  iv: new Uint8Array(12).fill(0),
+
+  // Plaintext: "test" (4 bytes)
+  plaintext: new Uint8Array([0x74, 0x65, 0x73, 0x74]),
+
+  // Expected values will be computed in tests
+} as const;
+
+/**
+ * Test vector for empty input
+ */
+export const EMPTY_TEST_VECTOR = {
+  description: "Empty plaintext test",
+
+  key: new Uint8Array(32).fill(0xaa),
+  iv: new Uint8Array(12).fill(0xbb),
+  plaintext: new Uint8Array(0), // Empty
+} as const;
+
+/**
+ * Test vector for large input (simulates real file)
+ */
+export const LARGE_TEST_VECTOR = {
+  description: "Large plaintext test (1KB)",
+
+  key: new Uint8Array(32).fill(0x42),
+  iv: new Uint8Array(12).fill(0x24),
+
+  // 1KB of data (pattern: 0x00, 0x01, 0x02, ..., 0xff repeated)
+  plaintext: new Uint8Array(1024).map((_, i) => i % 256),
+} as const;
+
+/**
+ * Helper function to convert Uint8Array to hex string (for debugging)
+ */
+export function toHex(buffer: Uint8Array): string {
+  return Array.from(buffer)
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+/**
+ * Helper function to convert hex string to Uint8Array
+ */
+export function fromHex(hex: string): Uint8Array {
+  if (hex.length % 2 !== 0) {
+    throw new Error("Invalid hex string (odd length)");
+  }
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < bytes.length; i++) {
+    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+
+/**
+ * Test data for HKDF key derivation
+ */
+export const HKDF_TEST_VECTOR = {
+  description: "HKDF key derivation test",
+
+  // Master key (256 bits)
+  masterKey: new Uint8Array(32).fill(0x2a), // "*" repeated
+
+  // Salt (filename hash)
+  filename: "test-file.pdf",
+
+  // Expected derived key will be computed in tests
+  // Different filenames should produce different keys
+  filenames: ["test-file.pdf", "another-file.jpg", "document.docx"],
+} as const;
+
+/**
+ * Test data for SHA-256 checksums
+ */
+export const CHECKSUM_TEST_VECTORS = [
+  {
+    description: "Empty input",
+    input: new Uint8Array(0),
+    expectedChecksum:
+      "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  },
+  {
+    description: "Simple text",
+    input: new TextEncoder().encode("Hello, World!"),
+    expectedChecksum:
+      "dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f",
+  },
+  {
+    description: "Binary data",
+    input: new Uint8Array([0x00, 0x01, 0x02, 0x03, 0x04]),
+    expectedChecksum:
+      "08bb5e5d6eaac1049ede0893d30ed022b1a4d9b5b48db414871f51c9cb35283d",
+  },
+] as const;