Encrypt or decrypt any text using strong AES-GCM encryption with a passphrase, entirely in your browser.
Sometimes you need to share a piece of sensitive text — a note, a set of credentials, a private message — through a channel you don't fully trust, like email or a shared chat. This Encryption / Decryption Tool solves that problem using AES-256-GCM, one of the strongest and most widely trusted symmetric encryption standards in use today, combined with a passphrase-based key derivation process, all running directly inside your browser using the native Web Crypto API.
Because everything happens client-side, your plaintext, your passphrase, and the resulting ciphertext never touch a server. This is a meaningful distinction from many "online encryption tools" that quietly process your data remotely — with this tool, if you disconnect your internet connection entirely after the page loads, encryption and decryption still work exactly the same, because there is genuinely nothing to send anywhere.
When you click Encrypt, the tool generates a random 16-byte salt and a random 12-byte initialization vector (IV) using your browser's cryptographically secure random number generator. Your passphrase is then run through PBKDF2 with 100,000 iterations of SHA-256 to derive a full 256-bit AES key — this deliberately slow process makes brute-force passphrase guessing significantly more expensive for an attacker, compared to using the passphrase directly as a key. The derived key then encrypts your text using AES-GCM, which also provides built-in authentication, meaning any tampering with the ciphertext will cause decryption to fail rather than silently return corrupted data.
The result is three Base64-encoded segments joined by periods: the salt, the IV, and the ciphertext itself. All three pieces are required to decrypt successfully, which is why they're bundled together into one string you can copy and share as a single block. None of these components is secret on its own — the real security comes entirely from the strength and secrecy of your passphrase, so choose one that is long and unique, ideally generated with our Password Generator tool.
People use this kind of tool to encrypt a note before pasting it into a support ticket, to protect a temporary credential shared over an insecure channel, to back up sensitive text in an encrypted form inside a personal notes app, or simply to learn hands-on how modern authenticated encryption actually works. Because decryption requires the exact same passphrase used during encryption, make sure you store or communicate the passphrase through a separate, trusted channel from the ciphertext itself — sending both together in the same message defeats the purpose entirely.
This tool is designed for short-to-medium length text, not large files. It also cannot recover your data if you forget the passphrase — there is no backdoor or recovery mechanism by design, since the security model depends entirely on the passphrase never being stored anywhere. Always keep a secure backup of anything important before relying solely on encrypted storage.
Since your passphrase is the only thing standing between an attacker and your encrypted text, treat it with the same care you'd give any critical password. A long, unique passphrase generated with our Password Generator tool, then stored safely in a password manager, gives you meaningfully stronger protection than a short or reused phrase you're relying on memory alone to protect.
AES-256-GCM, a modern authenticated encryption standard, with the encryption key derived from your passphrase using PBKDF2 (100,000 iterations, SHA-256).
Yes. As long as you have the exact ciphertext output and the exact passphrase, you can decrypt it in this same tool from any browser.
There is no recovery option. Because the key is derived entirely from your passphrase and never stored, forgetting it means the encrypted text cannot be recovered.
The ciphertext itself is safe to send over any channel since it's unreadable without the passphrase. Just make sure you share the passphrase separately, through a different channel.
Yes, once the page has loaded, all cryptographic operations run locally and require no network connection at all.
Idiot Security Tools