How safe do you think this is? Using simple passwords as a test there seems to be a very obvious pattern... for instance, if the password contains all the same letters (eg. aa) then the original data can be decrypted by simply looping through and subtracting 1 byte at a time until the data is valid. Using more complex passwords improves the protection but there is still a noticable pattern.