How to use
- Choose Encrypt, then Text or File.
- Enter the content and a password, twice.
- Click Encrypt and copy the encrypted text, or save the .enc file.
- To read it again, choose Decrypt, paste the text or pick the file, and enter the same password.
Options explained
- Algorithm
- AES-256 in GCM mode with a random salt and nonce. The key is derived from your password with PBKDF2-SHA256 and 600,000 iterations, which slows down password guessing.
- Files
- The file's name is stored inside the encrypted data, so decrypting gives back the original name. Encrypted files end in .enc.
What is in the encrypted data
The output is a short binary structure with a fixed layout:
| Part | Size | Purpose |
|---|---|---|
| Version | 1 byte | Currently 1 |
| Salt | 16 bytes | Random, makes the key different every time |
| Nonce | 12 bytes | Random, never reused with the same key |
| Ciphertext | Same as the input | The encrypted content |
| Authentication tag | 16 bytes | Detects a wrong password or any change |
That is 45 bytes of overhead. Text is shown as Base64, so a 5-byte message such as “hello” produces 50 bytes, which is 68 characters. A file is saved as the bytes themselves, with the name stored first inside the encrypted part (a 2-byte length followed by the UTF-8 name), so the .enc file is slightly larger than the original.
Because the salt and nonce are random, encrypting the same text with the same password twice gives different results. Both decrypt correctly. The key comes from PBKDF2 with HMAC-SHA256 and 600,000 iterations, the figure the OWASP password storage guidance gives for that function.
Frequently asked questions
What if I forget the password?
The data cannot be recovered. There is no back door, and nobody can reset the password.
How strong a password do I need?
Length matters most. A passphrase of four or more random words, or 12 or more random characters, is very hard to guess, because every guess has to go through the slow key derivation.
Can I decrypt it with other software?
The format is standard AES-GCM with PBKDF2, but its layout (version, salt, nonce, ciphertext) is specific to this tool, so the easiest way is to decrypt here.
Is anything sent to a server?
No. Encryption uses the Web Crypto API built into your browser, and neither the text nor the password leaves your device.
Privacy
This tool runs entirely in your browser. Your files and text are processed on your device and are never uploaded to our servers.