Password-encrypt any file into a .enc container and restore it later, with AES-256-GCM and no uploads
AES-256-GCM with a PBKDF2-HMAC-SHA256 key (210k iterations) and a random salt and IV per file. The header carries the original name and type and is authenticated as additional data, so changing a single byte breaks decryption.