Text Encryption (AES)
Encrypt any text with a password using AES-256-GCM, or decrypt a bundle someone sent you — entirely on your device.
Everything runs on your device — text and password are never sent anywhere. A lost password is unrecoverable.
How it works
- Choose the Encrypt tab, type or paste your text, and enter a password of at least 8 characters.
- Press Encrypt and copy the resulting Base64 bundle — it contains the salt, IV, and ciphertext in one string.
- To read it later, open the Decrypt tab, paste the bundle, enter the same password, and press Decrypt.
Frequently asked questions
- How does password-based AES encryption work in the browser?
- The tool uses the WebCrypto API built into every modern browser. Your password is stretched into a 256-bit key with PBKDF2 (310,000 SHA-256 iterations and a random salt), and that key encrypts your text with AES-256-GCM using a random IV. GCM also produces an authentication tag, so tampering or a wrong password is detected instead of producing garbage output.
- What format is the encrypted output?
- The output is a single Base64 string that bundles the 16-byte salt, the 12-byte IV, and the ciphertext with its GCM tag, in that order. Because everything needed for decryption (except the password) is inside the bundle, you can store or send it as one plain-text string and decrypt it here later on any device.
- Can I recover my text if I forget the password?
- No. There is no backdoor, account recovery, or master key — the encryption key exists only while the page derives it from your password. If the password is lost, the ciphertext is computationally infeasible to break, so treat your password with the same care as the data itself.
- Is my text or password sent to a server?
- No. Every step — key derivation, encryption, and decryption — runs locally in your browser using the WebCrypto API, and the page makes no network requests with your data. You can load the page, disconnect from the internet, and the tool keeps working.
- What can I use encrypted text bundles for?
- Common uses include sending credentials or API keys over email or chat, storing private notes in cloud documents, and keeping recovery codes in plain-text files. Share the bundle through one channel and the password through another — for example, paste the ciphertext in an email and tell the recipient the password by phone.
About this tool
This tool encrypts and decrypts text with AES-256-GCM, the same cipher used by HTTPS, disk encryption, and modern password managers. You provide a password; the tool turns it into a strong 256-bit key and produces a compact Base64 bundle you can paste anywhere plain text is accepted — email, chat, notes apps, or a file on a USB stick. Pasting the bundle back with the correct password restores the original text exactly.
Everything happens client-side through the WebCrypto API, which browsers implement in native code. Your password is run through PBKDF2 with 310,000 SHA-256 iterations and a freshly generated 16-byte random salt, which makes brute-force guessing and precomputed rainbow-table attacks dramatically more expensive. Encryption then uses a random 12-byte IV, so encrypting the same text twice yields completely different output. The salt, IV, and ciphertext are concatenated and Base64-encoded into one self-contained string. Nothing is uploaded, logged, or stored — the page works offline once loaded.
GCM mode is authenticated encryption, which matters in practice: if the bundle was modified in transit or you type the wrong password, decryption fails cleanly with an error instead of silently returning corrupted text. That property makes the tool suitable for sharing Wi-Fi passwords, license keys, server credentials, or personal notes across untrusted channels, provided the password travels separately.
Two practical tips. First, password strength is the weakest link — a short dictionary word can be brute-forced regardless of AES strength, so use a long passphrase of several unrelated words. Second, there is no recovery path by design: no server ever sees your key, so a forgotten password means the data is permanently unreadable. Keep the password somewhere as safe as the secret it protects.