Encrypt Text — AES-256-GCM in Your Browser
Encrypt a message with a passphrase — AES-256-GCM, key derived with PBKDF2, computed locally, with the key never stored.
Advanced — key derivation strength
Higher is slower to attempt and slower to guess. 600,000 is the current OWASP figure for PBKDF2-HMAC-SHA-256 and the default; it is recorded in the message, so a higher value still decrypts later.
—
What this tool does
It encrypts text with a passphrase you choose, using AES-256-GCM, and decrypts it again. The passphrase is stretched into a key with PBKDF2, a fresh random salt and IV are generated for every message, and the result is a single line of text you can paste anywhere. The work happens in your browser with the Web Crypto API: nothing is uploaded, and the passphrase and key are never stored — not in a cookie, not in local storage, not on a server.
What the message contains
The output is self-describing, so the recipient needs only the passphrase:
| Field | Purpose |
|---|---|
| AESGCM1 | The format version — so a future change to the defaults can still read old messages. |
| iterations | How many PBKDF2 rounds were used; recorded so decryption reproduces the same key. |
| salt | 16 random bytes that make the key derivation unique to this message. |
| iv | 12 random bytes for AES-GCM. Must never repeat under one key, so it is generated fresh. |
| ciphertext | The encrypted bytes, with GCM's authentication tag appended. |
None of that is secret — the salt and IV exist precisely because they can be public without weakening anything. All of the security lives in the passphrase.
Why the encryption is authenticated
AES-GCM is an authenticated mode: it produces a tag over the ciphertext, and decryption refuses to return anything if the tag does not match. That means a modified message is detected rather than silently decoded into nonsense — the failure mode of CBC used without a separate MAC, where a tampered ciphertext decrypts to garbage that looks like a successful result. It also means a wrong passphrase fails cleanly, because a wrong key produces a wrong tag.
The passphrase is the whole security
Nobody can break AES-256; they do not have to. An attacker who has your ciphertext can try passphrases offline, as fast as their hardware allows, so the only question is how long their guesses take. The 600,000 PBKDF2 iterations exist to make each guess expensive — a few hundred milliseconds of work rather than microseconds — but they cannot rescue a short or common passphrase. A long passphrase of several random words beats a short clever one by an enormous margin, and the password generator will make one. That is the honest limit of a browser tool: it is excellent for a message you need to send once, and the wrong place to keep a secret you cannot afford to lose.
Sending a secret to someone
Use two channels. Send the encrypted message by email, chat or a paste service, and give the passphrase over the phone or in person. The point of splitting them is that an attacker watching one channel holds only half of what they need. If the ciphertext and the passphrase travel together, the encryption has protected you against very little.
Frequently asked questions
What does the ciphertext envelope contain?
A self-describing string of the form AESGCM1.<iterations>.<salt>.<iv>.<ciphertext>. The prefix identifies the format and version; the iteration count and salt are needed to derive the same key from the passphrase; the IV is unique per message; the ciphertext includes the GCM authentication tag. Nothing is secret in the envelope — the passphrase is the only secret — but all of it is required to decrypt.
Is the passphrase-strength estimate meaningful?
It is an order-of-magnitude estimate of offline guessing against PBKDF2 with the iteration count shown, not a guarantee. PBKDF2 is deliberately slow, which raises the cost per guess, but a short or common passphrase is still guessable. Use a long random passphrase or a generated one, and treat the displayed time as a comparison between passphrases rather than a prediction.
Can another tool decrypt this envelope?
Only if it implements the same construction: AES-256-GCM, a key derived with PBKDF2-HMAC-SHA-256 at the stated iteration count, and the same salt/IV layout. The format is documented here but is not a standard interchange format, so OpenSSL or a password manager will not read it directly. For portability, encrypt with a standard tool; for a quick local message, this envelope is self-contained.
Is this safe to use for something important?
It is real AES-256-GCM with a real key derivation, and it runs entirely in your browser — nothing is sent anywhere. But be honest about what that does and does not buy you. It protects a message in transit (an email, a chat, a paste into a note) against anyone who sees the ciphertext but not the passphrase. It does not protect a weak passphrase: an attacker who has the ciphertext can guess passphrases offline, at leisure, so the passphrase is the whole security. For a long-lived secret, use a purpose-built password manager, not a web page you will close.
How does the encryption work, exactly?
Your passphrase is stretched into a 256-bit key with PBKDF2-HMAC-SHA-256 at 600,000 iterations — deliberately slow, so each guess costs real work. A random 16-byte salt makes that stretch unique every time, so a precomputed table is useless. The text is encrypted with AES-256-GCM under a fresh random 12-byte IV. The output carries the version, the iteration count, the salt, the IV and the ciphertext, so the recipient needs only the passphrase.
Why AES-GCM and not CBC?
Because GCM is authenticated. It attaches a tag that lets the recipient verify the ciphertext has not been altered, and it refuses to return a result if it has. CBC without a separate MAC will happily decrypt a modified message into garbage and report success — you would get plausible-looking nonsense with no signal that anything was wrong. With GCM, a wrong passphrase and a tampered message both fail loudly and identically.
What happens if I forget the passphrase?
The message cannot be recovered. There is no reset, no hint and no back door — the passphrase is never stored, and nothing in the envelope lets you reconstruct it. That is the point of encryption, and it is worth being certain about before you rely on it: keep the passphrase somewhere you will still have it in a year.
Can I use this to send someone a secret?
Yes, and the intended way is to send the ciphertext and the passphrase by two different routes — the message by email, the passphrase by phone or in person. That is what makes it work: an attacker who intercepts one channel sees only half the problem. If both travel together, the encryption has bought you very little.
Is the key or the passphrase stored anywhere?
No. The passphrase is used to derive a key in memory, and both are discarded when you close the tab. Nothing is written to localStorage, no cookie is set, and there is no server to receive it. If the page reloads, it has forgotten everything — so decrypt before you navigate away.
Go deeper
Longer explanations of the problems this tool solves:
Sources
- NIST SP 800-38D — Recommendation for Block Cipher Modes of Operation: GCM and GMAC.
- RFC 8018 — PKCS #5: Password-Based Cryptography Specification (PBKDF2).
- OWASP Password Storage Cheat Sheet — the PBKDF2-HMAC-SHA-256 iteration guidance.
Everything runs in your browser — nothing you type is uploaded.