I have some private text notes to store on my remote server. I'd like to encrypt my data in my web browser, using JavaScript, before uploading it. Here is what I currently do:

1. Edit my note in a textarea.
2. Click the Encrypt and upload button.
3. The JS asks for a new password.
4. This password is then prepared using PBKDF2.
5. Then the resulting key is used with AES-GCM to encrypt the note.
6. Uploading the encrypted data (and the initialization vector from step 5).

Question is:

Is it safe to use a hardcoded salt in step 4?

What would be the benefits of generating a random salt each time I click the Encrypt and upload button? (Then prepending the salt to the encrypted data and the initialization vector.)

How could an attacker benefit from a hardcoded salt in this case?

I have a private text note to store on my remote server. I'd like to encrypt my data in my web browser, using JavaScript, before uploading it. Here is what I currently do:

1. Edit my note in a textarea.
2. Click the Encrypt and upload button.
3. The JS asks for a new password.
4. This password is then prepared using PBKDF2.
5. Then the resulting key is used with AES-GCM to encrypt the note.
6. Uploading the encrypted data (and the initialization vector from step 5).

Question is:

Is it safe to use a hardcoded salt in step 4?

What would be the benefits of generating a random salt each time I click the Encrypt and upload button? (Then prepending the salt to the encrypted data and the initialization vector.)

How could an attacker benefit from a hardcoded salt in this case?