Lock text with a password using AES-256-GCM and PBKDF2, get one string to copy, and decrypt it later.
To encrypt text with a password, type the text and the password and press Encrypt text: the tool turns the password into a 256-bit key with PBKDF2-HMAC-SHA-256 and 600,000 iterations, encrypts the text with AES-256-GCM, and gives you one string that starts with yp1: and continues in Base64. Decrypting takes the same string and the same password. A new random salt and a new random 12-byte IV are made for every encryption, so the same text and password give a different string each time, and both strings decrypt. The password is normalized to Unicode NFC and read as UTF-8, so a password with an accent typed on two keyboards still matches. AES-GCM also authenticates: if any character of the string is changed, decryption fails instead of returning altered text.
After yp1: comes Base64 of these bytes in order: the iteration count as 4 bytes big-endian, the salt (16 bytes), the IV (12 bytes) and the AES-GCM ciphertext with its 16-byte tag at the end. The text yp1 is passed to AES-GCM as additional authenticated data. Because the iteration count is stored inside the string, you can change it under Iterations (100,000 to 2,000,000) and still decrypt without remembering the number. The size is predictable: 12 bytes of text, such as Hello, world, give a 60-byte envelope (4 + 16 + 12 + 12 + 16) and an 84-character string including yp1:. Any program with PBKDF2, SHA-256 and AES-GCM can decrypt it.
The strength of the result is the strength of the password. OWASP's Password Storage Cheat Sheet recommends 600,000 iterations for PBKDF2-HMAC-SHA256, and that is the default here; more iterations make every guess slower for an attacker and for you. A long passphrase is harder to guess than a short word, and there is no recovery: without the password the text cannot be read. A wrong password and a changed string give the same message, because AES-GCM cannot tell them apart. The length of the string shows roughly how long the text is, and anyone can see that it is encrypted text. Up to 1,000,000 characters of text are accepted, and the password is limited to 1,000 characters.
It encrypts text, not files, and it does not share the password with anyone: you must pass that on another way. It keeps no copy of your text, password or result, so save the encrypted string yourself; the Download button writes it to a .txt file. It needs a browser with Web Crypto on an https page. It is not a replacement for a password manager, an encrypted messenger or disk encryption. The work happens in your browser; the text and password are not uploaded or stored, only the iteration count you choose is remembered.
Type the text, type a password, and press Encrypt text. Copy the string that starts with yp1:. To read it later, choose Decrypt, paste the string and enter the same password.
AES-256 in GCM mode for the encryption, with the 256-bit key derived from your password by PBKDF2 using HMAC-SHA-256 and 600,000 iterations by default. The browser's own Web Crypto code does the work; no library is added.
Each encryption uses a new random 16-byte salt and a new random 12-byte IV. Two encryptions of Hello, world with the same password are both 84 characters long, have different content after yp1:, and decrypt to the same text.
The text cannot be recovered. Nothing is stored here and the password is not in the string. If decryption says it could not decrypt, check for a typo, a different keyboard layout, or a string that was cut when it was copied.
Yes. Read the string after yp1: as Base64: bytes 0 to 3 are the iteration count, 4 to 19 the salt, 20 to 31 the IV, and the rest the ciphertext plus a 16-byte tag. Derive a 32-byte key with PBKDF2-HMAC-SHA-256, decrypt with AES-256-GCM, and use the text yp1 as additional data.
No. The text and password are processed in your browser, in this tab, and no server receives them. Your choice of iteration count is saved in this browser; the text, password and result are not.