Text Encryptor & Decryptor (AES-256-GCM)
Encrypts text with a password into a Base64 string you can copy and share, and decrypts it on the same page. It uses the browser built-in Web Crypto API and everything stays in your browser. Your text and password are never sent to a server. You can check how strong a password is with the Password Strength Checker.
🔒 Runs in your browser · Your data is never sent to a server
Notes
- If you forget the password, the text cannot be decrypted. There is no way to reset or recover it.
- The strength of the encryption depends on the password. Avoid short or guessable passwords (you can check one with the Password Strength Checker).
- The ciphertext is a Base64 string of the version (1 byte), salt (16 bytes), IV (12 bytes), and ciphertext with its authentication tag, concatenated. The key is derived from the password with PBKDF2 (SHA-256, 600,000 iterations).
- Only text can be encrypted. To encrypt files, use the File Encryptor & Decryptor.
Glossary
AES-256-GCM
A symmetric cipher with a 256-bit key. GCM mode attaches an authentication tag while encrypting, so decryption fails if the ciphertext has been modified.
PBKDF2
A way to derive an encryption key from a password. Repeating the computation hundreds of thousands of times slows down brute-force password guessing.
Salt and IV
Random values chosen on every encryption, so the same text and password give a different ciphertext each time. They are stored inside the ciphertext, so you do not need to keep them separately.
FAQ
Why does the same text encrypt to a different result each time?
A new random salt and IV are chosen for every encryption. This is expected, and every result decrypts correctly with the same password.
Can I decrypt ciphertext made by other tools or OpenSSL?
No. The tool uses its own format (version, salt, IV, and ciphertext concatenated and Base64-encoded), so only strings it produced can be decrypted. The format is described in the notes on the page.
When do I get "Could not decrypt"?
When the password is wrong, or when part of the ciphertext is missing or modified. AES-GCM detects tampering, so even a single changed character makes decryption fail. Check that nothing was cut off or added when copying.
Does it support public-key encryption such as RSA?
Currently only password-based AES-256-GCM is supported. This tool does not do public-key encryption; for RSA-OAEP use the RSA Encrypt & Decrypt tool. For files, use the File Encryptor & Decryptor.
Share this page