Text encrypt & decrypt
Protect a message with a password using strong AES-256 encryption, right in your browser.
Files are processed in your browser and never uploaded.
How to use Text encrypt & decrypt
Add your input
Put your message to encrypt into the box on the page.
Set the options
Choose Password and Show. Nothing is hidden until you press a button.
Press Encrypt it, Don →
The result is produced on your own device, using your browser's own random and crypto functions where randomness is involved. Copy result, Don copies it.
What this tool does
AES-256-GCM authenticated encryption
AES-256-GCM is authenticated encryption, so a message that has been tampered with fails to decrypt rather than decrypting to something wrong.
Password-based key (PBKDF2, 250k rounds)
The key is derived from your password with PBKDF2 over 250,000 rounds, which is what makes guessing the password expensive.
Fresh salt and nonce every time
A fresh random salt and nonce are generated every time, so encrypting the same message twice never produces the same output.
Everything in your browser
Both encryption and decryption use the browser's own Web Crypto implementation rather than a script written for the page.
Nothing uploaded or stored
The message, the password and the result are never uploaded or stored. Close the tab and nothing remains.
Frequently asked questions
How secure is this?
It uses AES-256-GCM, a strong, modern, authenticated cipher, with the key derived from your password using PBKDF2 over 250,000 rounds and a fresh random salt and nonce each time. Everything runs in your browser and nothing is uploaded.
What happens if I forget the password?
The message cannot be recovered. There is no backdoor or reset, which is exactly what makes it secure, so store the password safely.
How should I share an encrypted message?
Send the encrypted text and the password through different channels, for example the text by email and the password by a phone call or messaging app, so intercepting one is not enough.
Why does decryption sometimes fail?
Decryption fails if the password is wrong or the encrypted text was altered or cut off. The authenticated cipher detects tampering and refuses rather than returning wrong text.
Is the password sent anywhere?
No. The password never leaves your browser; it is only used locally to derive the encryption key.
Last updated: