Free Text Encryptor

How this tool computes its result

Uses the Web Crypto API to perform AES-GCM encryption and decryption with passphrase-based key derivation. To encrypt, the tool generates a random 16-byte salt and 12-byte initialization vector (IV), derives a 256-bit AES key from the passphrase using PBKDF2 with SHA-256 hashing and 100,000 iterations, then encrypts the plaintext with AES-GCM. The output is a JSON object bundling version, base64-encoded salt, base64-encoded IV, and base64-encoded ciphertext. To decrypt, it reverses the process: parses the JSON payload, reconstructs the salt and IV from their base64 strings, re-derives the key using the same passphrase and salt, and decrypts the ciphertext using the IV. All operations run entirely in the browser with no server involvement.

Worked example

Entering plaintext "My secret message" with passphrase "MyPassword123" and clicking "Encrypt text" produces a JSON payload like {"v":1,"s":"base64_salt","i":"base64_iv","c":"base64_ciphertext"} containing unique salt and IV values generated fresh each time. Pasting that payload into Decrypt mode, entering the same passphrase "MyPassword123", and clicking "Decrypt payload" recovers the original "My secret message". Using a different passphrase results in a decryption error because the derived key will not match.

When not to use this tool

This is browser-based client-side encryption only — data transmitted over the network must still use HTTPS to be secure, and the passphrase strength is entirely dependent on what you choose, so a weak passphrase remains vulnerable to brute-force attack. It is not a replacement for end-to-end encrypted messaging platforms or file encryption tools that use public-key cryptography.

Common mistakes

• - Losing or misremembering the passphrase — there is no recovery mechanism because the tool never stores the plaintext, only the encrypted payload, so a forgotten passphrase makes decryption impossible.
• - Assuming the JSON payload output can be shared publicly — while the ciphertext is encrypted, the salt and IV are stored in plaintext within the JSON. An attacker with the JSON and your passphrase can decrypt it, so sharing the payload is equivalent to sharing the plaintext if the passphrase is weak.
• - Copying the payload to clipboard and then losing the clipboard history — the tool only generates the output in the Output field; if your browser or OS clears clipboard history, the encrypted payload may be lost permanently.

Related tools