AES Encrypt & Decrypt
Encrypt text or files with a password, using AES-GCM, CBC or CTR — all in your browser via the native Web Crypto API. Nothing you enter or encrypt ever leaves your device.
What do salt, IV, KDF iterations and the auth tag actually do?
Salt is 16 random bytes mixed into your password before deriving a key, so two people using the same password never end up with the same key — it defeats precomputed lookup tables. IV (initialization vector) is a per-encryption random value that makes sure encrypting the same data twice never produces the same ciphertext. KDF iterations is how many times PBKDF2 re-hashes your password — deliberately slow, so guessing a password by brute force takes proportionally longer. The auth tag (GCM) or HMAC (CBC/CTR) is a checksum computed over the ciphertext with a key derived from your password — if a single byte of the encrypted data is altered, or the password is wrong, that checksum fails to verify and decryption is refused outright rather than silently returning garbage.
{{ strength.label }} — {{ strength.feedback[0] }}
There is no password recovery. Losing this password means losing the data — write it down somewhere safe before relying on it for anything you can't afford to lose.
{{ error }}
{{ resultText }}
The link carries the ciphertext in the part after # — that part is never sent to any server, so the link is exactly as private as pasting the ciphertext yourself.
{{ decryptedText }}
Drop one or more files here
{{ mode === 'encrypt' ? 'Any file type · up to 20 files · 200 MB each' : 'Drop the .enc files this tool produced' }} · nothing uploaded
{{ status }}
{{ r.outName || r.name }}
{{ r.error }}
{{ error }}
All encryption and decryption runs in your browser using the native Web Crypto API. Your data and password never leave your device.
How this tool protects your data
Every operation — deriving a key from your password, encrypting, decrypting — runs through the browser's own Web Crypto API, the same implementation behind HTTPS and password managers. Nothing here is a hand-rolled cipher: correctness and side-channel safety matter too much for that, unlike a hash generator's hand-written digests, which are display tools rather than a security boundary.
A random salt and IV, every time
Encrypting the same text with the same password twice never produces the same ciphertext — a fresh random salt and IV are generated for every encryption and stored alongside the ciphertext itself, so decrypting only ever needs the password.
Why AES-192 sometimes can't be selected
Chromium-based browsers — Chrome, Edge, Brave — disabled AES-192 in their Web Crypto implementation; Firefox and Safari support it. This page checks for that support when it loads and falls back to AES-256 automatically rather than letting an encryption silently fail.
Large files are chunked, not loaded whole
Files are encrypted in fixed-size pieces, each with its own derived IV — reusing one IV across a whole file under the same key is exactly what GCM and CBC's security guarantees depend on not happening. Decrypting reassembles the pieces in order automatically.
Need to sign a message instead of hiding it?
Use the HMAC Generator — it proves a message came from someone holding a shared key without hiding the message itself.
Frequently asked questions
Is this safe to use for real secrets?
Yes — every operation runs through the browser's own Web Crypto API, the same audited implementation behind HTTPS and password managers. Nothing is hand-rolled here: no cipher code, no key-derivation code, and nothing is transmitted anywhere.
Can the ciphertext be reversed without the password?
Not in any practical sense. AES-256 has no known break, and the password is stretched through PBKDF2 tens of thousands of times specifically to make guessing slow. A short or common password is still the weakest link — use the generator if you don't need to remember it yourself.
What is the difference between AES-128, AES-192 and AES-256?
Just the key length, and with it the size of the space an attacker would have to search — 2^128, 2^192 or 2^256 possibilities. AES-128 is already far beyond brute-forcing with any known technology; AES-256 is the conservative default and what this tool recommends.
Why is AES-192 unavailable in some browsers?
Chromium-based browsers — Chrome, Edge, Brave — disabled AES-192 in their Web Crypto implementation; Firefox and Safari support it. This tool detects that at load time and falls back to AES-256 with a visible note rather than letting an encrypt silently fail.
What happens if I lose my password?
The data is unrecoverable. There is no backdoor, no master key and no reset — that is exactly what makes the encryption real. Write the password down somewhere safe before you rely on this for anything you can't afford to lose.
Is my data uploaded anywhere?
No. Key derivation, encryption and decryption all happen locally using JavaScript and the Web Crypto API. Nothing you type or drop onto the page is sent to a server.