AESSecurity & Network · 8 tools

Text Encryption

Protect a note, a message or a file with a passphrase. It is encrypted with AES-256-GCM in your browser and comes out as one line of text you can send by email or chat. Decrypt it here with the same passphrase.

Mode

INPUT

Without the passphrase, the text can't be recovered.
0 characters0 lines

OUTPUT

The encrypted text appears here.

Encryption runs in your browser. Your text, files and passphrase are never sent anywhere.

How to encrypt text

  1. Type or open

    Type or paste the text, or open a file of up to 100 MB.

  2. Choose a passphrase

    Use a long passphrase, such as several random words. Without it, the text can't be recovered.

  3. Encrypt and share

    Copy the encrypted text, which starts with DBX1:, or download the encrypted file. Send the passphrase separately, through another channel.

How it is encrypted

A key is derived from your passphrase with PBKDF2-SHA-256, 600,000 iterations and a random 16-byte salt, which makes every guess slow. The text is then encrypted with AES-256-GCM and a random 12-byte nonce. GCM also detects any change to the encrypted text, so a damaged or altered message fails to decrypt instead of producing garbage.

The format

Encrypted text is DBX1: followed by Base64 of the salt, the nonce and the ciphertext with its 16-byte authentication tag. Files use the same layout in binary after the four bytes DBX1, and keep the original file name inside the encrypted part. The passphrase is used as UTF-8 text. With these details, the data can also be decrypted with other tools.

Frequently asked questions

Is my text or passphrase sent anywhere?

No. Encryption and decryption use your browser's Web Crypto API on this device. Nothing you type or open is uploaded or stored.

What if I forget the passphrase?

Then the text can't be recovered. There is no back door and no reset, which is the point of encryption. Keep the passphrase in a password manager.

Why does decryption fail?

Either the passphrase is wrong, or the encrypted text was changed or cut off, for example by a missing character when copying. AES-GCM can't tell these apart, so check both. Upper and lower case in the passphrase matter.