Encrypt text with a password

The tool uses the Web Crypto API built into your browser; it doesn't implement its own cryptography.

• Cipher: AES-256-GCM, a widely used standard that both encrypts the text and detects any tampering.
• Key: derived from your password with PBKDF2-SHA256 and 600,000 iterations. The high iteration count makes each password guess slow for an attacker; 600,000 is the figure OWASP recommends for PBKDF2-HMAC-SHA256.
• Salt and IV: a fresh random 16-byte salt and 12-byte initialization vector for every encryption. That's why encrypting the same text twice gives two completely different results.

The output is a single Base64 string that contains a short header, the salt, the IV and the encrypted data with its authentication tag. Everything needed to decrypt is in that string, except the password.

Neither the text nor the password leaves your device. There is no server copy, no account and no way for anyone else to see what you encrypted.

Choose Decrypt, paste the entire encrypted text and enter the password. If the password is wrong, or if even one character of the encrypted text was changed or lost, decryption fails with a clear message instead of producing garbage. That's the authentication part of AES-GCM at work.

Right after encrypting you can click Try decrypting it to check that you typed the password you think you did.

Only text encrypted with this tool can be decrypted here; it isn't compatible with PGP, password-protected ZIP files or other formats.

Say you need to send a door code to a house sitter:

1. Type Side door code: 4821. Alarm off with the same code.
2. Enter a password such as maple-river-otter-42 twice and click Encrypt.
3. Email the long Base64 string that appears.
4. Text the password to the house sitter, or tell them in person.

They open this page, choose Decrypt, paste the string, enter the password and see the original message. Anyone who intercepts only the email sees meaningless characters.

• There is no recovery. We never see or store your password. If you forget it, nobody, including us, can decrypt the text.
• Use a long password. The meter under the field gives a rough guide: 12 or more characters, ideally several random words or a generated password from the password generator.
• Send the password separately. If you email the encrypted text, share the password by phone, in person or through a different app. Sending both in the same message defeats the purpose.
• Save it safely. A password manager is the best place for it.

Encryption protects the content, not the fact that a message exists. The length of the encrypted text also roughly reveals the length of the original.

• Sending a Wi-Fi password, door code or account details over email or chat.
• Storing private notes, recovery codes or a list of instructions in a cloud document, where only the encrypted version is saved.
• Sharing sensitive information with a family member or colleague who can get the password from you in person.
• Keeping a draft private on a shared computer.

For files rather than text, use a dedicated file encryption tool. For puzzles and games where breaking the code is the point, the Caesar cipher is the fun option, not a secure one.