Text Encryption

Text encryption with AES-256-GCM, done properly in your browser

This text encryption tool turns a message into an unreadable string that only someone with the password can open. It uses AES-256-GCM, the authenticated cipher used by TLS, with a key derived from your password by PBKDF2-SHA-256 at 600,000 iterations — the figure OWASP recommends for PBKDF2-HMAC-SHA256. All of it runs through the Web Crypto API built into your browser; nothing is sent to a server.

Use it to send a password, an API key, bank details or a private note over email, chat or a ticketing system, to keep a secret inside a plain-text file, or to password-protect a file before uploading it to shared storage. Decryption works the same way on any device: paste the string (or drop the .enc file), enter the password, done.

Because GCM is an authenticated mode, a wrong password or a single altered character produces a clear “decryption failed” error rather than garbage — you will never be fooled by a tampered message.

How to use the Text Encryption

1. Choose “Encrypt”, then “Text” or “File”.
2. Enter a password. A multi-word passphrase from the Passphrase Generator is ideal; the hint below the field rates what you typed.
3. Paste your message, or drop a file (up to 200 MB) onto the drop area.
4. Press “Encrypt text” and copy the UV1.… string, or “Encrypt file” to download the .enc file.
5. To decrypt, switch to “Decrypt”, paste the string or drop the .enc file, enter the same password and press the button. “Use result as input” flips the output straight back for a quick test.

Text Encryption features

How the encryption scheme works

Example: encrypting a 25-character message produces 16 + 12 + 25 + 16 = 69 bytes, which Base64 turns into 92 characters plus the 4-character prefix.

1. A random 16-byte salt and a random 12-byte IV (nonce) are generated with crypto.getRandomValues.
2. Your password (UTF-8) and the salt go through PBKDF2 with HMAC-SHA-256 for 600,000 iterations, producing a 256-bit AES key. This takes a fraction of a second for you but multiplies an attacker’s cost per guess by 600,000.
3. The message is encrypted with AES-256-GCM using that key and IV. GCM also produces a 16-byte authentication tag that covers the whole ciphertext.
4. The output is salt ‖ IV ‖ ciphertext ‖ tag, Base64-encoded and prefixed with UV1. (text) or the bytes UVENC1\0 (files). Everything needed to decrypt except the password is inside the output, so no settings have to be remembered.

Choosing a password that holds up

The ciphertext is only as strong as the password, because anyone who has the string can guess passwords offline with no rate limit. At 600,000 PBKDF2 iterations, a fast GPU manages only tens of thousands of guesses per second, so a random 12-character password or a five-word passphrase (about 65 bits) is far beyond reach, while a dictionary word with a number is not.

Send the password through a different channel from the ciphertext — for example the encrypted text by email and the password by phone or messenger. Never put both in the same message. You can test a candidate with the Password Strength Checker.

Limits and honest caveats

• Output from this tool uses its own simple container, not OpenPGP or the age format, so it can only be decrypted by this page (or by any code that follows the scheme above — it uses only standard primitives). For public-key encryption and signatures that GnuPG reads, use PGP encrypt and decrypt.
• Files are read fully into memory, so very large files may be slow or fail on phones; the limit is set to 200 MB for that reason.
• Encryption protects confidentiality and integrity, but not metadata: the length of the message and the file name of a .enc download are visible.
• If you forget the password there is no recovery. There is no back door, by design.
• To verify that a file arrived intact without encrypting it, use the File Hash Checker.