Text Encryptor
AES-256-GCM with a properly derived key — encrypted in your browser, never transmitted.
Start typing above and the result appears here.
How to use Text Encryptor
Enter your text and a passphrase
Use a long, random passphrase — the algorithm is strong, but it can only ever be as strong as what you type here.
Press Encrypt
Key derivation runs 600,000 rounds and takes a moment. That delay is the point: it is what makes guessing the passphrase slow for an attacker too.
Send the whole block
The output contains the salt and nonce it needs to decrypt. Copy all of it — a truncated block cannot be recovered.
Why use this text encryptor
Runs on your device
Your input is handled entirely in this browser tab. Nothing is uploaded, so there is nothing for us to store, log or leak.
No sign-up, no quota
No account, no daily limit, no watermark and no email wall. Use it once or two hundred times a day.
Built to be linked
Options are stored in the URL, so a configured tool is a link you can send to a colleague or bookmark.
Technical notes
Competitor research on this keyword found the same three mistakes repeatedly, each fatal: the passphrase used directly as the key, unauthenticated CBC or ECB mode, and a fixed or missing IV. This implementation derives the key with PBKDF2 at the OWASP-recommended work factor, uses authenticated AES-GCM, and generates a fresh random nonce for every message.
Measured on our own test set
- Key derivation
- 430 ms
- Encryption of 10 KB
- 0.1 ms
600,000 rounds — i5-6300U, Chrome 151, median of 8. The first run of a session is slower, around 1.1 s.
AES-GCM is hardware-accelerated; the key derivation is essentially the entire cost
Parameters, and why each one is set that way
| Parameter | Value | Why |
|---|---|---|
| Key derivation | PBKDF2-HMAC-SHA256 | A passphrase is not a key. Deriving one slowly is what stops dictionary attacks. |
| Iterations | 600,000 | OWASP Password Storage Cheat Sheet, current recommendation for SHA-256. |
| Salt | 128-bit, random per message | Stops one precomputed table attacking every message at once. |
| Cipher | AES-256-GCM | Authenticated. Tampering is detected instead of decrypting to garbage. |
| Nonce | 96-bit, random per message | Reusing a nonce with the same key breaks GCM completely. |
| Auth tag | 128-bit | Full-length tag; truncation weakens forgery resistance. |
Supported
- AES-256-GCM through the native Web Crypto API
- PBKDF2-HMAC-SHA256 at 600,000 iterations
- Random salt and nonce per message, packed into the output
- A version byte, so the format can change without silent mis-decryption
- Full Unicode plaintext
Limits and trade-offs
- The passphrase is the whole security boundary. A weak one defeats every parameter in the table above.
- There is no key recovery. Lose the passphrase and the text is gone permanently.
- This is not a password manager and not a file encryptor. Use a password manager for credentials, and age or GnuPG for files.
- It protects the message in transit or at rest. It does nothing about a compromised device.
If something goes wrong
- Decryption failed: wrong passphrase, or the encrypted text was altered
- GCM cannot tell those two apart — both fail authentication identically. Check the passphrase first, then check the whole Base64 block was copied, including the last line.
- That encrypted block is too short to be valid
- Part of it was lost in copying. The block contains a version byte, a 16-byte salt, a 12-byte nonce and a 16-byte tag before any message content.
Last verified August 2026 · benchmarks re-run each quarter.
Frequently asked questions
Is my text sent to a server?
No. Encryption and decryption both run in this browser tab through the Web Crypto API. You can load the page, disconnect from the internet, and it still works. For this tool in particular that is not a convenience — a text encryptor that uploads your plaintext is worse than useless.
What encryption does this use?
AES-256 in GCM mode. The key is derived from your passphrase with PBKDF2-HMAC-SHA256 at 600,000 iterations and a fresh 16-byte random salt, which is the current OWASP recommendation. Each message gets a new 12-byte random nonce.
Why does encrypting take a second?
Because of the 600,000 key-derivation rounds. That is deliberate. A fast key derivation is a fast dictionary attack — the delay you experience once is a delay an attacker experiences on every single guess.
What happens if I lose the passphrase?
The text is unrecoverable. There is no reset, no backup and no recovery key, because there is no account and no server. That is a consequence of the design, not an oversight.
Can someone modify the encrypted text without me knowing?
No. GCM is an authenticated mode: it produces a 128-bit tag over the ciphertext, and decryption fails outright if a single bit has changed. Unauthenticated modes like CBC would return plausible-looking garbage instead.
Should I use this to store passwords or important documents?
No. Use a password manager for credentials and a file-level tool like age or GnuPG for documents. This is for sending a short message over a channel you do not trust, where both sides already share a passphrase.
Why is there no API for this tool?
Because an API means sending the passphrase and the plaintext to a server, which removes the only property that makes the tool worth using. It is the one tool on this site deliberately excluded from the API.