Encrypt Text with a Password — Free AES-256 Online Tool
Type a message, pick a password, and get back a Base64 block that only someone with the same password can read. Encryption uses AES-256-GCM with a key derived by PBKDF2-HMAC-SHA256 over 600,000 iterations, all through the browser's built-in Web Crypto API. The text and the password stay on your device — there is no request to encrypt against.
How it works
- 1 Choose encrypt or decrypt Encrypt turns readable text into a Base64 block. Decrypt turns that block back into text. Pasting an encrypted block switches the mode for you.
- 2 Enter your text and a password Paste the message into the first box and type the password below it. A long passphrase of several unrelated words is far stronger than a short mixed-character password.
- 3 Copy the result Copy the Base64 output and send it however you like — chat, email, a note file. Share the password through a different channel, never in the same message.
Your data stays private
All processing happens entirely in your browser. No files, text, or data are ever sent to our servers. You can disconnect from the internet and this tool will still work.
Frequently asked questions
- What encryption does this use?
- AES-256 in GCM mode, with the key derived from your password by PBKDF2-HMAC-SHA256 at 600,000 iterations over a fresh 16-byte random salt. GCM is an authenticated mode, so the message is both encrypted and protected against tampering. Everything runs through the browser's native Web Crypto implementation.
- Can you or anyone else read my message?
- No. The page never sends the text or the password anywhere — you can open DevTools and watch the network tab stay silent, or disconnect from the internet after the page loads and it still works. Only someone with the password can decrypt the output.
- What happens if I lose the password?
- The message is gone. There is no recovery, no reset, and no backdoor. Brute-forcing a strong passphrase against 600,000 PBKDF2 iterations is not realistic. Store the password before you close the tab.
- Why is the output so much longer than my text?
- Each message carries a 33-byte header (version, iteration count, salt, IV) plus a 16-byte GCM authentication tag, and Base64 adds about 33% on top. For a short message the overhead dominates; for a long one it barely registers.
- Why does encrypting the same text twice give different results?
- A new random salt and a new random IV are generated every time. That is deliberate — identical output for identical input would tell an observer that you sent the same message twice.
- Is this good enough for real secrets?
- The cryptography is standard and sound. The weak points are elsewhere: your password strength, how you deliver the password to the other person, and whether the device itself is compromised. For files and long-term key management, use age, GPG, or a password manager built for it.