File Encrypt & Decrypt
Encrypts any file with AES-256-GCM from a passphrase, and decrypts files it produced.
Sending a file through e-mail or a chat app puts it on someone else’s disk in readable form. Encrypting it first with a passphrase you share by another channel means the copy in transit and the copy at rest are both meaningless without you. This does that with AES-256-GCM entirely inside the tab.
The file is encrypted in this tab with the browser’s own crypto. Neither the file nor the passphrase is uploaded, and nothing about either is stored — including by this page.
Drop the file to encrypt
Any file, any size your browser can hold in memory.
Exactly what is done to the file
- Cipher
- AES-256-GCM, 128-bit tag
- Key
- 256 bits, derived per file
- Key derivation
- PBKDF2 with HMAC-SHA-256, 600,000 iterations
- Salt
- 16 random bytes, new for every file
- Nonce
- 12 random bytes, new for every encryption
The result is a 38-byte header — a marker, the parameters, the salt and the nonce — and then the ciphertext. The header is authenticated along with the contents, so altering the iteration count in transit breaks decryption instead of quietly weakening it. The file name is not stored anywhere inside.
PBKDF2 rather than Argon2id, because it is what the browser itself provides and can be relied on; Argon2id resists GPUs better and would mean shipping a WebAssembly build this project cannot verify. That trade is named rather than hidden.
Lose the passphrase and the file is gone. There is no recovery, no hint and no back door — not because it would be difficult to add, but because a back door is the thing this protects against.
How to use it
Drop the file and set a passphrase
The passphrase is stretched into a key with PBKDF2 and a fresh random salt, so two encryptions of the same file with the same passphrase produce different bytes.
Send the passphrase separately
A passphrase in the same e-mail as the file protects nothing. Use a different channel, or the self-destructing note tool.
Decrypt on the other side
The same page decrypts what it produced. GCM authenticates as it decrypts, so a file altered in transit fails outright rather than yielding corrupted output.
Common questions
What happens if I forget the passphrase?
The file is gone. There is no recovery key, no reset and no back door — that is what makes it worth using. Write the passphrase down somewhere before you encrypt anything you cannot afford to lose.
Can someone else open it without this page?
The container is this tool’s own format — a small header with the salt, IV and parameters, then the GCM ciphertext. It is documented on the page and trivially reimplementable, but it is not a zip and not an OpenPGP file, so the recipient needs this page or the spec.
Is there a file size limit?
The limit is your browser’s memory, since the file is held in the tab rather than streamed to a server. Very large files may fail on a phone where they succeed on a desktop.
Does it hide the file name and size?
The name is stored inside the encrypted container, so it is hidden. The size is not — ciphertext length tracks plaintext length, and that is true of every tool of this kind.
Feed it from
PDF Password Protect
Encrypts a PDF with an open password and/or a permissions password — AES-256 by default, AES-128 and RC4 for old readers — and sets printing, copying, editing and annotation permissions.
Text Encrypt & Decrypt
Encrypts a message with AES-GCM from a passphrase and produces a self-contained Base64 blob.
Self-Destructing Note
Encrypts a note in the browser and gives you a one-time link that destroys the note after it is read.
PGP Message Tool
Encrypts and decrypts OpenPGP messages with a passphrase, entirely in the browser — RFC 4880 symmetric mode (AES-256, SHA-256 S2K, MDC), interoperable with gpg -c. Public-key encryption and signatures are not built.
Next
These accept what this tool produces, so the result can go straight in.
File Checksum
Hashes files of any size in a streaming pass and compares the result against a pasted expected value.
PDF Password Protect
Encrypts a PDF with an open password and/or a permissions password — AES-256 by default, AES-128 and RC4 for old readers — and sets printing, copying, editing and annotation permissions.
Self-Destructing Note
Encrypts a note in the browser and gives you a one-time link that destroys the note after it is read.
Text Encrypt & Decrypt
Encrypts a message with AES-GCM from a passphrase and produces a self-contained Base64 blob.
Archive Inspector
Opens a zip without extracting it and flags path traversal entries, executables, macros and zip bombs.
Audio Converter
Converts between MP3, WAV, FLAC, AAC, OGG and Opus with bitrate and sample-rate settings.