Text encryption tool
Turn a message into a block of text that only the right password can open, and turn it back. The key is derived with PBKDF2 and the text is sealed with AES-256-GCM using the Web Crypto API; nothing leaves your device.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- Choose Encrypt, type or paste your text and a password, and press Run.
- Copy the result and store or send it.
- To read it, choose Decrypt, paste the whole text, enter the same password and press Run.
How it works
The password and a random salt go through PBKDF2 with HMAC-SHA-256 for 600,000 iterations (the OWASP-recommended minimum for that setup) to make a 256-bit key. AES-GCM then encrypts the UTF-8 text with a random IV and appends an authentication tag, so any change to the data is detected when decrypting.
Tips
- Share the password through a different channel from the encrypted text.
- Encryption hides the content, not the fact that a message exists or roughly how long it is.
- Decryption refuses iteration counts above 10 million so a forged header cannot freeze your tab.
Frequently asked questions
How strong is this encryption?
AES-256-GCM is a standard authenticated cipher. The weak point is the password, because the key comes from it. A long, random passphrase matters far more than anything else here.
What is in the encrypted text?
Five parts separated by dots, written in Base64URL. They are the format tag nz1, the PBKDF2 iteration count (600000), a random 16-byte salt, a random 12-byte IV and the ciphertext with its 16-byte authentication tag. The iteration count is stored so the text can still be opened if the default is raised later.
Why does the same text encrypt differently each time?
A fresh random salt and IV are made for every run, as they must be. Both are stored in the output and are not secret.
Can I decrypt this elsewhere?
Yes, with any tool that can do PBKDF2-HMAC-SHA256 with the stored salt and iterations to make a 256-bit key and then AES-GCM with the stored IV. The tool is not a standard file format like OpenPGP, so ordinary apps will not open it directly.
What if I forget the password?
The text cannot be recovered. There is no reset and nothing is stored on a server. A wrong password and a damaged text give the same error because the authentication tag fails in both cases.