By security I mean that encoded string is indistinguishable from random noise and is different on every encryption of the same text so it is impossible to make a guess on encryption algorithm used or do any dictionary attack on the encoded text.

Second: output string length does not correspond to the input string length in easy way, so it is not possible of make guessing on that account.

Third: it is possible to verify that the provided password is incorrect so the decoding function could return false instead of supposedly decoded random string.