Encrypt and Decrypt Text and Files with a Password (AES-256)

What this tool does

This tool locks a piece of text or a whole file with a password, and unlocks it again when you give the same password. The result is unreadable to anyone who does not have the password, including anyone who gets hold of the encrypted text or file. It uses AES-256-GCM, a standard cipher that is also used for web traffic, with a key made from your password by PBKDF2-SHA-256 with 600,000 rounds. All of it runs in your browser through the Web Crypto functions the browser already has. Your text, your file and your password are not sent anywhere.

How to use it

Choose Encrypt, then type or paste text, or press "Encrypt a file" (or drop a file on the page).
Enter a password and repeat it. The second box is there because a typing mistake would lock your data for good.
Press Encrypt. For text you get a line of letters, digits, hyphens and underscores (Base64URL) that you can copy into a note, a message or a file. For a file you download a .enc file.
To unlock, choose Decrypt, paste the text (or open the .enc file), enter the password and press Decrypt. A file comes back with its original name and every byte unchanged.

What happens inside

Each time you encrypt, the tool draws a fresh random 16-byte salt and a random 12-byte nonce from the browser's secure random generator. PBKDF2-SHA-256 stretches your password and the salt through 600,000 rounds into a 256-bit key, which is the number the OWASP password storage guidance gives for this function. AES-256-GCM then encrypts your data and adds a 16-byte authentication tag. Because the salt is new every time, the key is new every time, so the same password and the same text never produce the same output twice.

The result is a small, versioned envelope: three bytes "ENC", one version byte, the round count, the salt, the nonce, then the encrypted data with its tag. The whole 36-byte header is covered by the authentication tag, so changing any part of it, for example to lower the round count, makes decryption fail instead of weakening it. A text of n bytes becomes n + 53 bytes: the word "hello" (5 bytes) is 58 bytes, which is 78 Base64URL characters. The text form always starts with RU5DAQ, which is "ENC" and the version written in Base64. A file's name is stored inside the encrypted part, not in the header.

Choosing a password

The encryption is strong, so the password is the weak point. PBKDF2 slows down every guess, but it was not designed to resist specialised graphics cards the way newer functions do, so length matters most. Four random words from a list of 7,776 give about 52 bits of unpredictability, five give about 65 and six about 78. A long phrase of random words is easy to remember and far better than a short password full of symbols. The password generator makes random passwords, and you can keep the result in a password manager. Passwords are normalised (Unicode NFKC) before use, so a Vietnamese password typed with composed or decomposed accents works the same on every device.

What it cannot do

Recover a lost password. There is no reset and no copy of your key anywhere. If the password is gone, the data is gone.
Hide that something is encrypted, or roughly how big it is. The length of the result follows the length of the input. The download name is the original name plus .enc, so rename the file if the name itself is sensitive.
Protect you from a compromised device. A keylogger or a hostile browser extension can read what you type on any website.
Replace an audited tool. The code is short and checked against published test vectors, but it has not had an independent security audit. For life-critical secrets use established software such as an audited password manager or encrypted disk.

The result opens only in this format, not in OpenSSL or an archive tool. If you need to share a secret, send the encrypted text in one message and the password through a different channel. For other conversions see the Base64 tool, the file hash checker to confirm a file arrived intact, and the TOTP generator for two-factor codes.

Frequently asked questions

Is it safe to type a password on a website?

Here the page does the work inside your browser and never sends the text, the file or the password anywhere, and nothing is saved. The remaining risk is your own device: a keylogger or a browser extension that can read pages could see what you type, on this or any site. Use a device and browser you trust.

I forgot the password. Can you recover the data?

No, and neither can anyone else. The password is the only thing that makes the key, and it is never stored. This is the price of encryption that nobody else can undo, so keep the password in a password manager.

Why is the error the same for a wrong password and for damaged data?

AES-GCM checks an authentication tag. If the key is wrong or a single bit of the data or header was changed, the check fails in the same way, so the tool cannot tell which one happened. Check the password first, then check that the text was copied completely.

What do the 600,000 rounds mean, and why does it take a moment?

PBKDF2 repeats a hashing step 600,000 times to turn your password into the key. It costs a legitimate user a fraction of a second, but it multiplies the work of someone trying millions of guesses. The count is stored in the header, so a later version can raise it and old data still opens.

Can I open the result with OpenSSL, 7-Zip or another program?

Not directly. The envelope is this tool's own format (described above), chosen so it can be checked and rebuilt, but other programs expect their own layouts. Keep using this page, or any implementation of the same layout, to open it.

How large can a file be?

Up to 100 MB. AES-GCM encrypts the file in one piece, so the browser holds the file and its result in memory at the same time. Larger files are refused with a message rather than risking a frozen tab.