Encrypt & Decrypt Text
Protect any message with a password using AES-256-GCM, the same authenticated encryption used by password managers. Or decrypt a ciphertext someone sent you. Nothing leaves your browser — not the text, not the password.
Use a long passphrase. The same password is required to decrypt — there is no recovery.
💡 Finding This Encryption Tool Useful?
Get the standalone version — a single HTML file you can keep on your machine and open anytime, offline, with no scripts loaded from anywhere.
🛒 Get the Standalone Version🔍 What Is Encrypt & Decrypt Text?
Encrypt & Decrypt Text is a tool that turns readable text into an unreadable cipher using a password, and turns that cipher back into the original text when the correct password is supplied. This tool uses AES-256-GCM — the Advanced Encryption Standard with a 256-bit key in Galois/Counter Mode — which is an authenticated cipher: it not only hides the content but also detects any tampering. The key is derived from your password using PBKDF2 with 600,000 iterations, which makes brute-forcing the password slow. Everything runs in your browser using the Web Crypto API. Your text and password are never sent anywhere.
✨ Key Features
AES-256-GCM
Authenticated encryption. Tampered ciphertext fails to decrypt rather than producing garbage.
PBKDF2 Key Stretching
600,000 iterations of SHA-256 turn a short password into a 256-bit key, making brute-force attacks impractical.
Fresh Salt & IV Every Time
A random 16-byte salt and 12-byte IV are generated per encryption, so the same message with the same password produces a different ciphertext each time.
Base64 Output
The ciphertext is Base64-encoded so it can be pasted into any text field, email, or chat.
Password Generator
Built-in generator creates a strong random password using crypto.getRandomValues.
No Upload, No Storage
There is no backend. The Web Crypto API handles everything in the page. Nothing is logged or transmitted.
📖 How to Use Encrypt & Decrypt Text
- Choose a mode — Encrypt or Decrypt at the top of the tool.
- Enter a password — for encryption, use a strong passphrase; for decryption, use the exact password used to encrypt.
- Paste your text — plaintext if encrypting, Base64 ciphertext if decrypting.
- Click Encrypt or Decrypt — the result appears in the output box.
- Copy the output — send it to the recipient along with the password through a separate channel.
💡 Pro tip: Send the ciphertext by email and the password by SMS or a different messaging app. If both travel through the same channel, an attacker who compromises that channel gets both.
🎯 Practical Use Cases
Confidential Messages
Encrypt a note before sending it over email, chat, or a support ticket.
Sharing Credentials
Encrypt an API key or password before pasting it into a shared document.
Encrypted Backups
Encrypt a block of text you want to store somewhere less trusted.
Testing Crypto Code
Generate a known-good AES-GCM ciphertext to test your own implementation against.
Private Notes
Encrypt a journal entry or a piece of sensitive information you need to keep but not hide.
Client Handoff
Send a configuration file or credential to a client with a password agreed over the phone.
⚠️ Important Notes and Limitations
Encryption is only as strong as the password and the handling. A few honest caveats:
• The password is the entire security. AES-256-GCM itself is not breakable with current technology, but a weak password can be brute-forced. Use a long, random passphrase — ideally generated by the tool itself.
• There is no password recovery. If you forget the password, the ciphertext cannot be decrypted. There is no backdoor, no reset link, no recovery key. That is by design.
• Send the password separately from the ciphertext. If both travel through the same channel (same email thread, same chat), an attacker who compromises that channel has everything needed to decrypt.
• This tool uses the Web Crypto API, which requires a secure context. It works over HTTPS and from file:// (the standalone edition), but not over plain HTTP. If you open the tool from a server without HTTPS, encryption will fail.
• The output is Base64, not text. It contains characters like +, /, and =. If a channel strips or alters them, decryption will fail. Prefer channels that preserve raw text.
• This is symmetric encryption. Both parties must know the same password. It is not public-key encryption and cannot be used to send a message to someone without first sharing a secret.
❓ Frequently Asked Questions
No. The tool uses the browser's built-in Web Crypto API (window.crypto.subtle), which performs all cryptographic operations locally. There is no server component, no analytics that capture input, and no network request containing your text or password. You can verify this by opening your browser's network panel while using the tool — no request is made with your data.
AES-256-GCM for the actual encryption, with a key derived from your password using PBKDF2 (Password-Based Key Derivation Function 2) with SHA-256 and 600,000 iterations. GCM mode provides both confidentiality and integrity — if the ciphertext is modified in any way, decryption fails with an error rather than returning corrupted plaintext. The 600,000 iteration count follows OWASP's 2023 recommendation for PBKDF2-HMAC-SHA256.
Because a fresh random salt (16 bytes) and IV (12 bytes) are generated for every encryption. The salt is mixed into the key derivation, so the same password produces a different key each time. The IV ensures the same key still produces different ciphertext for each message. Both values are bundled with the ciphertext, so decryption can reproduce them. This is standard practice and is required for AES-GCM to be secure — reusing an IV with the same key would be catastrophic.
Only if that tool uses the exact same format: AES-256-GCM with a PBKDF2-derived key, the same iteration count (600,000), the same hash (SHA-256), and the same packaging (salt + IV + ciphertext, Base64-encoded). This tool uses a specific format that is documented in the code. If you need to interoperate with another tool, you would need to match its format exactly. The standalone edition includes a documented format specification.
The ciphertext cannot be decrypted. There is no recovery mechanism, no backdoor, and no way to brute-force a strong password in a reasonable time. This is the correct behaviour for encryption — if there were a recovery path, an attacker could use it too. Store your passwords in a password manager.
Yes. Once the page is loaded — whether from this Blogger post or from the standalone HTML file — the Web Crypto API works without any network connection. The standalone edition is a single HTML file that can be opened directly from disk and used on an air-gapped machine.
👨💻 About the Author — GenieDevs
📦 Get the Standalone Version
🔐 Encrypt & Decrypt Text – Standalone Edition
One self-contained HTML file with the full AES-256-GCM tool inside. Keep it on your machine, run it from a USB stick, or use it on an air-gapped computer — no internet connection needed.
✅ Final Takeaway
Most people have something they need to send that they would rather not put in a plain email: a password, an API key, a private note. This tool gives you a way to protect that content with a password, using the same cryptography that protects your bank connection. The ciphertext is safe to paste anywhere. The password is the only thing you need to keep secret — and if you send it through a different channel, you have effectively created a secure channel out of an insecure one.