diff --git a/js/crypto.js b/js/crypto.js
index 58adc92..f780afb 100644
--- a/js/crypto.js
+++ b/js/crypto.js
@@ -3,79 +3,198 @@
  *
  * 文件格式: [8B magic "METONA1\0"][16B salt][12B IV][AES-256-GCM ciphertext]
  * 后缀: .metona
+ * 安全上下文(HTTPS)下使用 AES-256-GCM，否则降级为 XOR 混淆
  */
 
 const MAGIC = new TextEncoder().encode('METONA1\0');
 const PASSPHRASE = 'metona-ollama-v2';
 const PBKDF2_ITERATIONS = 100000;
 
+const SECURE = !!(globalThis.crypto && globalThis.crypto.subtle);
+
 /**
- * 导入派生密钥
+ * SHA-256 哈希 (降级模式用)
  */
-async function deriveKey(salt) {
-    const keyMaterial = await crypto.subtle.importKey(
-        'raw',
-        new TextEncoder().encode(PASSPHRASE),
-        'PBKDF2',
-        false,
-        ['deriveKey']
-    );
-    return crypto.subtle.deriveKey(
-        { name: 'PBKDF2', salt, iterations: PBKDF2_ITERATIONS, hash: 'SHA-256' },
-        keyMaterial,
-        { name: 'AES-GCM', length: 256 },
-        false,
-        ['encrypt', 'decrypt']
-    );
+async function sha256(data) {
+    if (SECURE) {
+        const buf = await crypto.subtle.digest('SHA-256', data);
+        return new Uint8Array(buf);
+    }
+    // 纯 JS SHA-256
+    return sha256js(data);
+}
+
+/**
+ * 纯 JS SHA-256 实现 (兼容非安全上下文)
+ */
+function sha256js(message) {
+    const K = new Uint32Array([
+        0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+        0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+        0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+        0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+        0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+        0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+        0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+        0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+    ]);
+
+    const bytes = message instanceof Uint8Array ? message : new Uint8Array(message);
+    const bitLen = bytes.length * 8;
+
+    // 预处理: padding
+    const paddedLen = Math.ceil((bytes.length + 9) / 64) * 64;
+    const padded = new Uint8Array(paddedLen);
+    padded.set(bytes);
+    padded[bytes.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(paddedLen - 4, bitLen, false);
+
+    let h0 = 0x6a09e667, h1 = 0xbb67ae85, h2 = 0x3c6ef372, h3 = 0xa54ff53a;
+    let h4 = 0x510e527f, h5 = 0x9b05688c, h6 = 0x1f83d9ab, h7 = 0x5be0cd19;
+
+    const w = new Uint32Array(64);
+
+    for (let offset = 0; offset < paddedLen; offset += 64) {
+        for (let i = 0; i < 16; i++) {
+            w[i] = view.getUint32(offset + i * 4, false);
+        }
+        for (let i = 16; i < 64; i++) {
+            const s0 = (w[i - 15] >>> 7 | w[i - 15] << 25) ^ (w[i - 15] >>> 18 | w[i - 15] << 14) ^ (w[i - 15] >>> 3);
+            const s1 = (w[i - 2] >>> 17 | w[i - 2] << 15) ^ (w[i - 2] >>> 19 | w[i - 2] << 13) ^ (w[i - 2] >>> 10);
+            w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0;
+        }
+
+        let a = h0, b = h1, c = h2, d = h3, e = h4, f = h5, g = h6, h = h7;
+
+        for (let i = 0; i < 64; i++) {
+            const S1 = (e >>> 6 | e << 26) ^ (e >>> 11 | e << 21) ^ (e >>> 25 | e << 7);
+            const ch = (e & f) ^ (~e & g);
+            const temp1 = (h + S1 + ch + K[i] + w[i]) >>> 0;
+            const S0 = (a >>> 2 | a << 30) ^ (a >>> 13 | a << 19) ^ (a >>> 22 | a << 10);
+            const maj = (a & b) ^ (a & c) ^ (b & c);
+            const temp2 = (S0 + maj) >>> 0;
+
+            h = g; g = f; f = e;
+            e = (d + temp1) >>> 0;
+            d = c; c = b; b = a;
+            a = (temp1 + temp2) >>> 0;
+        }
+
+        h0 = (h0 + a) >>> 0; h1 = (h1 + b) >>> 0; h2 = (h2 + c) >>> 0; h3 = (h3 + d) >>> 0;
+        h4 = (h4 + e) >>> 0; h5 = (h5 + f) >>> 0; h6 = (h6 + g) >>> 0; h7 = (h7 + h) >>> 0;
+    }
+
+    const result = new Uint8Array(32);
+    const rv = new DataView(result.buffer);
+    rv.setUint32(0, h0, false); rv.setUint32(4, h1, false);
+    rv.setUint32(8, h2, false); rv.setUint32(12, h3, false);
+    rv.setUint32(16, h4, false); rv.setUint32(20, h5, false);
+    rv.setUint32(24, h6, false); rv.setUint32(28, h7, false);
+    return result;
+}
+
+/**
+ * 从 passhprase + salt 派生密钥 (PBKDF2 或降级多次哈希)
+ */
+async function deriveKeyBytes(salt) {
+    const passBytes = new TextEncoder().encode(PASSPHRASE);
+    const input = new Uint8Array(passBytes.length + salt.length);
+    input.set(passBytes);
+    input.set(salt, passBytes.length);
+
+    if (SECURE) {
+        const keyMaterial = await crypto.subtle.importKey('raw', passBytes, 'PBKDF2', false, ['deriveKey']);
+        const key = await crypto.subtle.deriveKey(
+            { name: 'PBKDF2', salt, iterations: PBKDF2_ITERATIONS, hash: 'SHA-256' },
+            keyMaterial,
+            { name: 'AES-GCM', length: 256 },
+            true,
+            ['encrypt', 'decrypt']
+        );
+        const raw = await crypto.subtle.exportKey('raw', key);
+        return new Uint8Array(raw);
+    }
+
+    // 降级: 多次哈希模拟密钥派生
+    let key = input;
+    for (let i = 0; i < 10000; i++) {
+        key = await sha256(key);
+    }
+    return key;
+}
+
+/**
+ * XOR 加密/解密 (降级模式)
+ */
+function xorBytes(data, keyBytes) {
+    const out = new Uint8Array(data.length);
+    for (let i = 0; i < data.length; i++) {
+        out[i] = data[i] ^ keyBytes[i % keyBytes.length];
+    }
+    return out;
 }
 
 /**
  * 加密 JSON 数据 → .metona 二进制格式
- * @param {object} data - 要加密的对象
- * @returns {Blob} .metona 文件内容
  */
 export async function encryptData(data) {
     const json = new TextEncoder().encode(JSON.stringify(data));
     const salt = crypto.getRandomValues(new Uint8Array(16));
     const iv = crypto.getRandomValues(new Uint8Array(12));
-    const key = await deriveKey(salt);
-    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, json);
+    const keyBytes = await deriveKeyBytes(salt);
 
-    // 拼接: magic + salt + iv + ciphertext
-    const blob = new Blob([MAGIC, salt, iv, ciphertext]);
-    return blob;
+    let payload;
+    if (SECURE) {
+        const key = await crypto.subtle.importKey('raw', keyBytes, 'AES-GCM', false, ['encrypt']);
+        const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, json);
+        payload = new Uint8Array(ciphertext);
+    } else {
+        // 降级: XOR 混淆，前 4 字节存原始长度
+        const lenBytes = new Uint32Array([json.length]);
+        const withLen = new Uint8Array(4 + json.length);
+        withLen.set(new Uint8Array(lenBytes.buffer));
+        withLen.set(json, 4);
+        payload = xorBytes(withLen, keyBytes);
+    }
+
+    // 标记加密模式: SECURE=0x01, FALLBACK=0x00
+    const flag = new Uint8Array([SECURE ? 1 : 0]);
+
+    return new Blob([MAGIC, salt, iv, flag, payload]);
 }
 
 /**
  * 解密 .metona 文件 → JSON 对象
- * @param {ArrayBuffer} buffer - .metona 文件内容
- * @returns {object} 解密后的对象
  */
 export async function decryptData(buffer) {
     const data = new Uint8Array(buffer);
 
     // 校验 magic
-    const magic = data.slice(0, 8);
-    for (let i = 0; i < MAGIC.length; i++) {
-        if (magic[i] !== MAGIC[i]) {
-            throw new Error('不是有效的 .metona 文件');
-        }
+    for (let i = 0; i < 8; i++) {
+        if (data[i] !== MAGIC[i]) throw new Error('不是有效的 .metona 文件');
     }
 
     const salt = data.slice(8, 24);
     const iv = data.slice(24, 36);
-    const ciphertext = data.slice(36);
+    const mode = data[36];
+    const payload = data.slice(37);
+    const keyBytes = await deriveKeyBytes(salt);
 
-    const key = await deriveKey(salt);
-    let decrypted;
-    try {
-        decrypted = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext);
-    } catch {
-        throw new Error('文件已损坏或格式不正确');
+    let jsonBytes;
+    if (mode === 1) {
+        // AES-GCM
+        const key = await crypto.subtle.importKey('raw', keyBytes, 'AES-GCM', false, ['decrypt']);
+        const decrypted = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, payload);
+        jsonBytes = new Uint8Array(decrypted);
+    } else {
+        // XOR 降级
+        const withLen = xorBytes(payload, keyBytes);
+        const len = new DataView(withLen.buffer).getUint32(0, true);
+        jsonBytes = withLen.slice(4, 4 + len);
     }
 
-    const json = new TextDecoder().decode(decrypted);
-    return JSON.parse(json);
+    return JSON.parse(new TextDecoder().decode(jsonBytes));
 }
 
 /**