AES-GCM with PBKDF2. Use at least 12 characters and keep the password separately. There is no recovery service.