Encrypt and decrypt text with AES-256
Encrypt text with AES-256-GCM and PBKDF2 in your browser, producing one self-contained base64 block you can paste anywhere. Decrypt it back just as easily.
- Runs in your browser
- Nothing you enter is sent
- Free, no account
The encryption happens in this tab. Your text and your password are handed to the browser’s built-in crypto.subtle implementation and nowhere else. No key, no plaintext and no ciphertext is ever transmitted — you can confirm that by watching the network panel while you press Encrypt.
If you lose the password, the text is gone. There is no reset link, no recovery key and no back door — that is the entire point of encrypting it. Write the password down somewhere safe, or store it in a password manager, before you close this page.
0 characters
A passphrase of several random words beats a short mangled word — the key is only ever as strong as this.
Typed twice on purpose: a typo here is unrecoverable.
| Offset | Size | Field | Purpose |
|---|---|---|---|
| 0 | 4 bytes | Magic | The ASCII letters OTD1, so a wrong paste is caught before any key derivation happens. |
| 4 | 4 bytes | Iterations | PBKDF2 iteration count, big-endian. Stored so the count can be raised later without breaking old messages. |
| 8 | 16 bytes | Salt | Random per message. Makes precomputed rainbow tables useless and gives two identical messages different keys. |
| 24 | 12 bytes | Nonce (IV) | Random per message, 96 bits — the size AES-GCM is specified for. Never reused, because reuse breaks GCM completely. |
| 36 | rest | Ciphertext + tag | AES-256-GCM output with its 16-byte authentication tag appended, exactly as WebCrypto returns it. |
The whole structure is then base64-encoded. Header overhead is 36 bytes plus the 16-byte tag, so a short note grows by about 90 base64 characters.
How to encrypt text with a password
- Paste the text into the Encrypt tab. Recovery codes, a private note, a credential you need to hand to a colleague — anything you would rather not send in the clear.
- Choose a strong password and type it twice. The confirmation field exists because a typo here is unrecoverable. A passphrase of five or six random words is the right shape for this job.
- Press Encrypt. The short pause is the key derivation doing 200,000 rounds of PBKDF2 — deliberate work that an attacker has to repeat on every single guess.
- Copy the base64 block. It contains everything needed to decrypt except the password, so it can travel through email, chat or a text file safely.
- Send the password through a different channel. Never in the same message. A phone call, a different app, or a password manager's secure-share feature.
To go the other way, open the Decrypt tab, paste the block and enter the password. The tool inspects the envelope header as soon as you paste — before any password is entered — so you can see immediately whether the text is a valid envelope and how many iterations it was built with.
What actually happens to your text
| Step | Algorithm | Detail |
|---|---|---|
| Salt generation | crypto.getRandomValues | 16 fresh random bytes per message. |
| Key derivation | PBKDF2-HMAC-SHA256 | 200,000 iterations, producing a 256-bit key. |
| Nonce generation | crypto.getRandomValues | 12 fresh random bytes — the size AES-GCM is specified for. |
| Encryption | AES-256-GCM | Authenticated encryption: confidentiality plus a 128-bit integrity tag. |
| Packaging | Base64 | Magic, iteration count, salt, nonce and ciphertext in one printable block. |
Every one of those primitives is the browser's own crypto.subtle implementation —
native, audited code, not a JavaScript reimplementation of AES. The tool publishes the exact
byte layout of the envelope on the page so the format is verifiable, and so you could decrypt
it with any other AES-GCM implementation if this page ever disappeared.
Why a fresh salt and nonce every time
The salt makes the derived key different for every message even when the password is the same, which defeats precomputed tables and stops an attacker who cracks one message from getting the others for free. The nonce is more critical still: AES-GCM breaks catastrophically if a nonce is reused with the same key — an attacker can recover the authentication key and forge messages. Both are drawn fresh from the CSPRNG for every encryption, which is why encrypting the same text twice produces two completely different outputs.
Why 200,000 iterations
PBKDF2 has one job: make each password guess expensive. Without it, a password is hashed once and an attacker tests billions of candidates per second. With 200,000 iterations of HMAC-SHA256, the same hardware manages a few tens of thousands per second — roughly a million-fold slowdown. You pay for it too, but only once, and only for a fraction of a second. The iteration count is stored in the envelope so it can be raised in future without breaking messages encrypted today.
What this tool does not protect against
- A weak password. AES-256 is unbreakable; a password that is in a wordlist is not. The key is derived from the password, so the password is the ceiling. The tool shows a live strength estimate for exactly this reason.
- Losing the password. There is no reset, no recovery key, no back door. If the password is gone, so is the text — permanently, by design.
- Metadata. Anyone who intercepts the message learns its approximate length and that it was encrypted with this format. The content is hidden; the existence of the content is not.
- A compromised device. If there is a keylogger on your machine, encryption performed on that machine does not help.
- Key exchange. You still have to get the password to the other person somehow. That is the hard part of cryptography, and this tool does not solve it — public-key systems like PGP or Signal exist for that.
When to use this, and when to use something else
This is the right tool for a one-off secret going through a channel you do not fully trust: pasting a set of recovery codes into a note-taking app, emailing a colleague a temporary credential, keeping a small private record inside an otherwise-synced file. It is quick, it leaves no installation behind, and the output is plain text you can put anywhere.
Reach for something else when you need ongoing key management, signatures proving who sent a message, or protection for whole files and directories. Signal for conversations, age or PGP for files with a public-key workflow, an encrypted archive or a full-disk volume for bulk data, and a password manager for credentials you use repeatedly.
Understanding "decryption failed"
If the password is wrong, the tool cannot tell you that specifically — it can only tell you that the authentication tag did not verify, which happens both when the key is wrong and when the ciphertext has been altered by so much as one bit. That ambiguity is a security property: it is what stops an attacker from modifying your message and having it decrypt to something plausible. Check for a stray character introduced by copy and paste, then check the password.
Questions
What exactly does the encryption do?
Your password is stretched into a 256-bit key with PBKDF2-HMAC-SHA256 over 200,000 iterations and a fresh 16-byte random salt. That key encrypts your text with AES-256-GCM under a fresh 12-byte random nonce. The salt, nonce, iteration count and ciphertext are packed into one binary envelope behind an "OTD1" marker and base64-encoded. The page publishes the byte layout so you can verify or re-implement it.
What happens if I lose the password?
The text is unrecoverable. There is no reset link, no recovery key and no back door, which is the entire point. Two hundred thousand PBKDF2 iterations mean even a well-funded attacker pays that cost on every single guess — and so would you. Store the password in a password manager before you close the page.
Why does decryption not tell me whether the password was wrong or the text was damaged?
Because AES-GCM genuinely cannot distinguish the two. It verifies an authentication tag over the whole ciphertext; if the tag does not match, the key was wrong or the bytes were altered, and there is no way to tell which. That is a security property, not a missing feature — it means nobody can modify your ciphertext undetected.
Is this as good as GPG or an encrypted archive?
The primitives are the same ones those tools use, and they are the browser’s own audited implementations rather than JavaScript reimplementations. What it does not give you is public-key exchange, signatures, key management or metadata protection. It is the right tool for sending a short secret through a channel you do not trust; it is not a replacement for a full encryption suite.
Can I send the output over email or chat?
Yes — that is what the base64 envelope is for. It contains only printable ASCII, survives copy and paste, and line breaks are ignored on decryption. Send the password separately, through a different channel, and never in the same message.