Free tool · ENCRYPT
Encrypt and Decrypt Text with a Password
Turn a message into AES-256-GCM ciphertext that only someone with the password can read. Everything happens in your browser.
Runs 100% in your browser. Nothing you type or upload is sent anywhere or stored.
AES-256-GCM with a key derived by PBKDF2-SHA256 (600,000iterations), a random salt and IV each time, via your browser's Web Crypto API. No server is involved, so if you forget the password nobody can decrypt it.
How it works
This tool encrypts text with AES-256-GCM using a key made from your password, then gives you the result as base64. Paste that output and the same password back in to get the original text. No account, no upload, no server step.
What happens when you click Encrypt
- Your browser creates a random 16-byte salt and a random 12-byte IV.
- PBKDF2-SHA256 runs 600,000 times over your password and the salt to produce a 256-bit key. The high count slows down guessing.
- AES-GCM encrypts the text and adds a 16-byte authentication tag, so any change to the output makes decryption fail.
- The version byte, salt, IV and ciphertext are joined and encoded as base64.
Because the salt and IV are random, encrypting the same text twice gives different output. That is expected. The security rests on the password, so use a long one: a five or six word passphrase is a good fit.
Be clear about what this is: a quick way to protect a snippet of text. It is not a replacement for an end-to-end encrypted messenger or for encrypting whole files and disks.
Read more: What is AES-256 encryption?, Zero-knowledge, explained.
Questions
Yes. It uses the browser's built-in Web Crypto API with AES-256-GCM, which also detects tampering. The key is derived from your password with PBKDF2-SHA256 at 600,000 iterations and a random 16-byte salt, and each message gets a random 12-byte IV.
No. The password never leaves your browser and we never see the encrypted text either. Without the password the output cannot be decrypted by us or anyone else, so store the password somewhere safe.
Encrypt the text, send the base64 output by one channel (email, chat), and share the password by a different one (in person, a phone call). The recipient opens this page, pastes the output, enters the password and clicks Decrypt.
It is as strong as your password: a short or reused password can be guessed offline. It does not hide that a message exists, it does not sign messages to prove who sent them, and it cannot protect text on a device that already has malware. For ongoing private conversations use an end-to-end encrypted messenger.
The format is documented: base64 of a version byte, 16-byte salt, 12-byte IV, then AES-GCM ciphertext with its 16-byte tag. Anyone can write a decryptor with standard libraries, but it is not compatible with OpenSSL or PGP formats out of the box.
