1. An apparatus to encrypt a payload, comprising: a session key generator configured to generate a session key; a hasher configured to generate a hash of the session key; a payload encrypter configured to encrypt the payload with the session key, to encrypt both the session key and the hash of the session key using a received password, and to store in a file: the encrypted payload, the password-encrypted session key, and the encrypted hash of the session key; wherein the payload encrypter is further configured to encrypt the session key using a fallback key, and append the fallback-encrypted session key to the file; wherein the payload encrypter is further configured to send the file to a receiver; a decryptor, coupled to the receiver, the decryptor configured to receive the password, and to decrypt the password-encrypted session key to obtain a decrypted session key, and to decrypt the encrypted hash of the session key to obtain a first hash of the session key; a second hasher configured to hash the decrypted session key to obtain a second hash of the session key; a comparer configured to compare the first hash of the session key with the second hash of the session key; and wherein the decryptor is further configured to decrypt the encrypted payload, using the session key decrypted with the password, when the first hash of the session key matches the second hash of the session key; wherein the decryptor is further configured to decrypt, in response to determining that the first hash of the session key does not match the second hash of the session key, the fallback-encrypted session key, using the fallback key, and to decrypt the encrypted payload using the session key decrypted with the fallback key.