paul-sh

I think you use this to validate the password, not to check the integrity of the message. And an attacker gets a password as a result of brute-forcing, not a hash. Look at this snippet in pseudocode:

    // Get the hash and the encrypted text from the encrypted data
    hash = substing(encryptedData, 0, 64);
    encryptedText = substing(encryptedData, 64);

    foreach password in PasswordDictionary {
      if hash == HMAC(encryptedText, SHA256(password)) {
        print "Password found: " + password;
        // Decrypt the message 
        print "Message: " + AESDecrypt(encryptedText, password);
      }
    }

The loop will run fast, and you get a clear-text password as a result, which can decrypt the message. If you replace SHA256(password) with PBKDF2(password, 20000) the loop becomes insanely slower.

The site compares MACs in the client's browser, so a timing attack is not really an issue here.

Ikkez, you use hash == HMAC-SHA256(CT, SHA256(password)) to check if the password is valid. You should replace the "SHA256(password)" part here with a strong password-based key derivation function (PBKDF2, scrypt, bcrypt) with a decent number of iterations.

SHA256 is blazing fast. While this is a good thing for a hash function in general, it is not for a key derivation. PBKDF2, scrypt, bcrypt and others are slow by design to make an attack much harder.

You shouldn't have minified the code, let people check what's going on.