Encrypt & Decrypt Text with a Password (AES-256 → Base64)
Encrypt a message with a password right in your browser — the text and password are never uploaded or stored. AES-GCM-256 + PBKDF2 packed as portable Base64 you can paste anywhere and decrypt later.
🔒 Runs entirely in your browser. Your input and output are never sent to a server or stored — fully private.
🔒 Encrypted and decrypted entirely in your browser — the message and password never leave your device; nothing is uploaded or stored. Output packs salt (16 B) + IV (12 B) + AES-GCM-256 ciphertext as Base64; the key comes from PBKDF2-SHA-256 with 310,000 iterations. Without the password the text cannot be recovered.
About this tool
Your message and password never touch a server: unlike web services that encrypt on their backend, everything here runs inside your browser with the Web Crypto API. Type or paste any text, choose a password, and it is sealed with AES-GCM-256 (key derived via PBKDF2-SHA-256, 310,000 iterations). The result is a compact Base64 string that survives email, chat apps and plain text files, so you can send it over any channel. The recipient opens this same page, pastes the string and enters the shared password to read it — even offline.
Frequently asked questions
Is the Base64 output safe to send over email or chat?
Yes — the string is just the AES-GCM ciphertext plus its salt and nonce, encoded so it pastes cleanly anywhere. Without the password it is computationally useless to anyone who intercepts it, and the 310,000 PBKDF2 iterations make guessing passwords deliberately slow. The one rule: share the password over a different channel than the message itself, for example encrypt in email but pass the password by phone.
What does the recipient see with a wrong password?
A clean error message, never garbled text. AES-GCM is authenticated encryption: an integrity tag is verified before any plaintext is released, so decryption either yields the exact original message or fails outright. This also means a message that was truncated or altered in transit — a chat app cutting off characters, say — is detected rather than silently producing wrong content. If decryption fails, check the password and make sure the whole string was copied.
Does my message pass through your server?
Never. Encryption and decryption both run entirely in your browser with the Web Crypto API; the plaintext, the password and the Base64 result are not transmitted, logged or stored by this site. Only the ciphertext you choose to send travels anywhere, over whichever channel you pick. Once the page has loaded, the tool keeps working with your network disconnected — feel free to verify.