Text Encryption

Turn a message into an encrypted block with a passphrase, and turn it back again — in this tab.

Runs on your deviceTextWorkingNo account needed

What this tool does

Text Encryption encrypts your message with AES-256-GCM, using a key derived from your passphrase by PBKDF2-SHA256. Every run draws a fresh 16-byte salt and a fresh 12-byte initialisation vector from the browser's cryptographic random source, so encrypting the same sentence twice with the same passphrase produces two entirely different blocks. The salt, the initialisation vector, the round count and a short format marker travel alongside the ciphertext inside a base64 envelope, which is why decryption asks you for nothing but the passphrase.

GCM is an authenticated mode, so the block carries a 16-byte tag computed over its own contents. Alter a character of the ciphertext in transit — a chat client mangling a copy, or somebody editing it deliberately — and decryption fails outright instead of returning plausible-looking rubbish. The price of that strictness is that a wrong passphrase and an altered block are indistinguishable to the tool, and both surface the same message.

The format is this tool's own. Blocks open with the marker OKE1 and a version byte, and nothing else in the world reads them: not GPG, not OpenSSL enc, not an archive password prompt. Whoever receives a block has to bring it back to this page, or write code against the same envelope. If your recipient needs to decrypt with tooling they already have, or you want public-key exchange so that no shared secret has to travel at all, OpenPGP is the right answer and this is the wrong one.

The work happens in your browser through the Web Crypto API; the message and the passphrase are not transmitted, and nothing is kept once you close the tab. Three limits are worth knowing before you rely on it. The passphrase box is an ordinary visible text field rather than a masked one, so it is readable by anyone looking at your screen. A forgotten passphrase ends the matter — there is no reset and no recovery path. And encryption hides the content, not the shape: every block spends a fixed 53 bytes on the envelope and the tag before the message is counted, so a 37-character note comes back as 120 characters of base64 and a longer note as a proportionally longer block. The size, and the fact that you sent anything at all, still show.

How to use it

  1. Choose Encrypt or Decrypt. The direction changes what the panel offers. Decrypting hides the rounds field, because the round count is read back out of the block itself.
  2. Type a passphrase. It is used to derive the key and is neither stored nor sent. Length does more than punctuation here: a long phrase you can retype beats a short one with symbols wedged into it.
  3. Set the key strengthening rounds. 250,000 by default, adjustable between 10,000 and 2,000,000. More rounds raise an attacker's cost per guess, and raise your own device's cost on every single run by the same factor.
  4. Copy the block out, or paste one back in. Output wraps at 76 characters unless you switch wrapping off. Coming back the other way, whitespace and any -----BEGIN----- style header lines are stripped first, and the URL-safe characters - and _ are read back as + and /, so a block that travelled through a link still opens.

Processing & privacy

Runs on your device. Your file is processed directly in this browser.

Common use cases

Putting a secret message through a chat app

Chat history sits on servers you do not run and syncs to every device on the account. A block in the thread is readable only by whoever also holds the passphrase.

Keeping a recovery code in a plain notes file

Notes and to-do apps sync in the clear. Storing the code as ciphertext means an exposed sync account is not automatically an exposed account key.

Passing something through a system that only accepts text

The output is plain base64, so it survives email bodies, ticket comments, form fields and paste sites that would strip or refuse an attachment.

Confirming a block arrived intact

Because GCM authenticates as it decrypts, a successful decryption is also evidence that no byte changed between sending and reading. It says nothing about who wrote the block, though — anyone holding the passphrase could have made a fresh one.

Questions

Is my message sent anywhere?
No. Encryption and decryption both run in this browser tab through the Web Crypto API, and neither the text nor the passphrase leaves it. The page itself has to load over the network once — there is no offline install — but after that you can disconnect completely and it still encrypts and decrypts, which is the simplest way to check the claim yourself.
Can other software decrypt these blocks?
No. The envelope — the OKE1 marker, a version byte, the round count, the salt and the initialisation vector, all ahead of the ciphertext — belongs to this tool, so GPG, OpenSSL and archive utilities will not read it. Anyone decrypting must use this page or code written against the same layout.
What happens if I forget the passphrase?
The message is gone. The key is derived fresh for each operation and never stored, no part of the site can read a block without the right phrase, and there is no reset link. Treat the passphrase as the only copy of the message.
How many key rounds should I choose?
250,000 is a sensible default. Raising it multiplies an attacker's cost per guess, but multiplies yours identically, and PBKDF2 is not memory-hard, so a graphics card still works through candidates far faster than your laptop does. Passphrase length buys you more than the rounds field ever will.
Why does it reject a passphrase I know is right?
The authentication tag fails for a wrong passphrase and for an altered block alike, and the tool genuinely cannot tell the two apart. The usual culprit is the block rather than the phrase: a chat client that converted a character into a smart quote, or a copy that lost its last line.
Can I encrypt a file with this?
No, it takes typed or pasted text only. For a document, Protect PDF puts a password on a PDF; other kinds of file are better served by an encrypted archive or your operating system's own disk encryption.
Is the passphrase masked while I type it?
No. It is an ordinary text input, so it stays visible on screen and in any screen recording or shoulder-surfing range. Type it somewhere private, and clear the field before you hand the laptop over.

Related tools