Encrypt/Decrypt Text
Encrypt text with a password using AES-256-GCM, or decrypt text that was encrypted this same way - all performed locally in your browser.
Recommended Settings
Pro Tips
- •The same password must be used to decrypt as was used to encrypt - there's no way to recover the text if the password is lost
- •A new random salt and IV are generated for every encryption, so encrypting the same text twice with the same password produces different-looking output each time
- •This uses AES-256-GCM, an authenticated encryption mode - if the encrypted text is tampered with, decryption will fail rather than silently return corrupted data
- •Use a genuinely strong, unique password - the encryption is only as strong as the password protecting it
Most Popular
Most users encrypt a short secret or note to share with someone else through a separate secure channel for the password
When to Use This Tool
Encrypt sensitive text before sending it somewhere you don't fully trust.
Encrypt sensitive notes before saving them somewhere else.
See how password-based symmetric encryption works in practice.
Generate reference encrypted values while developing encryption-related code.
How It Works
Derive a strong 256-bit encryption key from your password using PBKDF2 with a random salt and 250,000 iterations
Encrypt your text with AES-256-GCM using that key and a random initialization vector (IV)
Combine the salt, IV, and ciphertext together and encode the result as Base64 for easy copying - decryption reverses this process
100% Private
Files never leave your device. All processing happens locally in your browser.
Lightning Fast
Powered by Web Crypto API (AES-GCM, PBKDF2) for optimal performance on modern browsers.
Open Source
Built with verified, open-source libraries. Fully transparent.
Frequently Asked Questions
What happens if I forget the password?
The text cannot be recovered - there's no backdoor or password reset. Strong encryption is only useful if losing the password also means losing access, which is by design.
Is my data sent to a server?
No. All encryption and decryption happens entirely in your browser using the Web Crypto API. Nothing is transmitted anywhere.
How strong is this encryption?
AES-256-GCM is a strong, widely trusted encryption standard used in many production systems, and PBKDF2 with 250,000 iterations makes password-guessing attacks significantly slower.
Why did decryption fail?
This usually means the password is incorrect, or the encrypted text was altered or truncated - AES-GCM deliberately fails rather than returning corrupted output when something doesn't match.
Can I encrypt more than just short text?
Yes, though very large amounts of text will take longer to process since everything runs in your browser rather than on a server.