Encrypt any file with a passphrase into a downloadable .enc file, or decrypt one back to the original file.
Sometimes a single line of text isn't enough, you need to protect an entire file: a document, a spreadsheet, an archive, or any other file type before storing it somewhere less trusted or sending it through a channel you'd rather not expose the contents to. This File Encryption / Decryption Tool extends the same AES-256-GCM approach used in our text-based Encryption/Decryption tool to work directly on files of any type, entirely inside your browser, with the encrypted result downloaded straight to your device.
Just like every other tool on this site, your file is never uploaded anywhere. The browser's File API reads the selected file's bytes locally, the Web Crypto API performs the actual encryption or decryption entirely in memory, and the result is offered back to you as a direct download, all without a single byte of your file's content ever leaving your device across a network connection.
When you encrypt a file, this tool builds a small custom binary container that bundles everything needed for later decryption into one self-contained .enc file: a magic header identifying it as coming from this tool, a random salt, a random initialization vector, your original filename (so it can be restored automatically), and finally the AES-256-GCM encrypted file content itself. Your passphrase is run through PBKDF2 with 100,000 iterations to derive the actual encryption key, the same deliberately slow, brute-force-resistant approach used throughout this site's encryption tools.
Encrypted files are, by nature, unreadable and often awkward to organize since their contents can't be inspected by simply looking at them. Storing the original filename securely inside the encrypted container itself (rather than leaving it visible in the plaintext .enc filename, which typically just appends ".enc" to whatever name you had) means that when you decrypt the file later, you get back exactly the file you started with, complete with its original name and extension, without having to remember or manually re-type it.
This is well suited for encrypting a single sensitive file before uploading it to cloud storage you don't fully trust, attaching it to an email you want an extra layer of protection on, or archiving something private on a shared or removable drive. Because everything happens in your browser's memory, very large files may be slower to process or run into browser memory limits, this tool is best suited for individual documents and moderate-sized files rather than multi-gigabyte archives.
Exactly as with our text encryption tool, there is no way to recover an encrypted file if you lose the passphrase, the security model depends entirely on that passphrase never being stored anywhere. Use a strong, unique passphrase (our Password Generator tool can help), and communicate it to any intended recipient through a channel separate from the encrypted file itself.
After decrypting, it's good practice to confirm the resulting file opens correctly and matches what you expect, especially for critical documents. If you want an extra layer of confidence for extremely important files, consider computing a hash of the original file before encrypting it and comparing that same hash against the decrypted result afterward using our File Hash Verifier tool, giving you cryptographic confirmation that nothing was altered in the round trip.
No. Both operations happen entirely inside your browser using the File API and Web Crypto API. Your file's content is never transmitted over a network.
It's stored securely inside the encrypted container itself and automatically restored when you decrypt the file, so you don't need to remember or retype it.
No, this tool uses its own specific container format. You can only decrypt .enc files that were created by this same tool.
There's no hard-coded limit, but very large files may be slow or run into your browser's available memory, since the entire file is processed in memory during encryption or decryption.
There is no recovery option. The encryption key is derived entirely from your passphrase and never stored, so forgetting it means the encrypted file cannot be recovered.
Idiot Security Tools