Text Encrypt & Decrypt
Encrypt a message with a password using AES-GCM and PBKDF2, then share the Base64 result. Decrypt it back with the same password. Strong, authenticated, and entirely in your browser.
How the encryption works
Your password is stretched into a 256-bit key with PBKDF2 (150,000 SHA-256 rounds and a random salt), then the message is sealed with AES-GCM, which also authenticates it so any tampering is detected. The salt, a random initialisation vector and the ciphertext are packed together and shown as Base64. To decrypt, paste that Base64 back in with the same password.
All cryptography runs in your browser via the Web Crypto API. There is no password recovery, if you lose the password, the message cannot be read.
What this does
This tool encrypts a message with a password using AES-GCM, returning a Base64 string you can share, and decrypts it back with the same password.
How to use it
- Enter your message and a password.
- Encrypt to get a Base64 result.
- Share it with someone who has the password.
- Paste it back to decrypt.
How it works
A 256-bit key is derived from your password by PBKDF2 (150,000 SHA-256 rounds with a random salt), then AES-GCM encrypts and authenticates the message, so any tampering is detected on decryption.
Understanding your result
The output is a self-contained Base64 blob that bundles the random salt and nonce with the ciphertext, so the same message encrypts to a different string every time, that is expected, not an error. There is no password recovery and no back door: lose the password and the message is unrecoverable, and AES-GCM refuses to decrypt rather than return garbage if the password is wrong or the text was altered, so a failed decrypt means the input or password is off.
Example
A short note becomes an unreadable Base64 blob that only the matching password can unlock.
Sources & methodology
Last updated .
Frequently asked questions
How strong is the encryption?
It uses AES-GCM with a 256-bit key derived from your password by PBKDF2 (150,000 SHA-256 rounds with a random salt). AES-GCM also authenticates the message, so any tampering is detected on decryption.
What if I forget the password?
There is no recovery. The password is the only way to derive the key, so a lost password means the message cannot be decrypted.
Does my message or password leave my device?
No. All cryptography runs locally via the browser Web Crypto API; nothing is uploaded or stored.
Related tools
Base64 Encoder & Decoder
Encode text to Base64 or decode Base64 back to text, with a URL-safe (base64url) option. UTF-8 aware, so emoji and accented characters round-trip perfectly. Runs in your browser.
URL Encoder & Decoder
Percent-encode text for safe use in URLs or decode it back, with component, full-URI and form (application/x-www-form-urlencoded) modes. Private and instant, all in your browser.
HTML Encoder & Decoder
Convert text to HTML entities or decode entities back to plain text. Handles named entities and numeric (decimal and hex) references. Escape markup safely, all in your browser.
JWT Decoder
Decode a JSON Web Token to read its header and payload, with standard time claims (iat, exp, nbf) shown as readable dates and an expiry check. Decoding only, done privately in your browser.