Hey look it’s a “static” HTML file that decrypts itself using AES 256 CBC. Sure, that sounds static and simple and good for the web. What could go wrong.

Some obvious limitations:

-requires users to re-authenticate for every protected file on your site

-assets loaded by the page not password protected

-uses a single password globally shared by everyone who wants to read the doc

-archiving the page itself is useless unless you also archive the password, which must be done out of band

-this doesn’t compose or integrate with the web: none of the common tools you would use to download, spider, archive, spindle, mutilate web pages know how to deal with this

It’s certainly one solution. The http basic auth built into every popular webserver is another, with none of the above limitations. But I guess that would require spending 5 minutes learning and implementing some server config, and why do that when you can further ruin the web by shoving yet more user hostile complexity into client side JavaScript.

Sorry to sound bitter I just feel this is a really bad idea if you think about it for any length of time.