Text Encryption
Encrypt and decrypt sensitive text snippets locally using authenticated AES-GCM 256-bit encryption. Zero-knowledge PBKDF2 key derivation with 100,000 rounds and random salts.
AES-GCM-256 Symmetric Cipher
shrtx1.salt.iv.ciphertext+tag
Client-Side Authenticated Text Encryption
Text Encryption provides end-to-end symmetric encryption and decryption for sensitive notes, passwords, API tokens, and confidential communication directly inside your browser. Powered by native Web Crypto API implementations of the Advanced Encryption Standard in Galois/Counter Mode (AES-GCM), all data is secured using 256-bit keys.
Unlike legacy ciphers (such as AES-CBC without authentication), AES-GCM provides authenticated encryption with associated data (AEAD). This ensures that ciphertext cannot be altered, reordered, or tampered with without causing immediate decryption failure, completely mitigating padding oracle attacks.
Keys are derived from user-chosen passphrases using PBKDF2 with SHA-256 and 100,000 iterations combined with cryptographically secure 128-bit random salts and 96-bit initialization vectors (IVs). The tool generates transportable JSON or compact strings suitable for storage or transmission over untrusted channels.
Core Tool Capabilities
- cryptographic standard AES-256-GCM: Industry-standard authenticated symmetric cipher providing confidentiality and cryptographic tamper-evidence.
- Robust PBKDF2 Key Derivation: Derives 256-bit keys from passphrases using 100,000 SHA-256 iterations and unique 16-byte random salts to thwart dictionary and rainbow table attacks.
- Unique Random IV per Operation: Generates a fresh 12-byte cryptographically secure initialization vector (IV) for every encryption operation.
- Dual Export Formats: Export encrypted payloads as compact single-line strings (shrtx1.) or formatted structured JSON envelopes.
- Tamper-Proof Decryption: AES-GCM 128-bit authentication tag guarantees that any modification to ciphertext or parameters triggers immediate rejection.
Local Browser Privacy
Your files are processed locally on your device. Files are not uploaded, transmitted, or stored on remote servers.
Once the page has loaded, you can disconnect your network connection and continue using this tool offline.
Target Use Cases
- • Secure Communication over Untrusted Channels
- • Personal Offline Vault
- • Development Secret Sharing
Technical Specifications & Platform Limits
Authenticated encryption with 128-bit integrity tag.
NIST-recommended password hashing and key stretching.
Cryptographically secure random entropy per encryption.
Client-side offline execution.
Browser-native hardware-accelerated SubtleCrypto.
Step-by-Step Workflow
Enter Sensitive Message
Type or paste the confidential text, note, or credential you wish to encrypt.
Provide Strong Passphrase
Enter a memorable, high-entropy passphrase and confirm it in the matching field.
Select Output Format
Choose between a Compact String (single-line sharing) or Structured JSON.
Encrypt & Copy
Click 'Encrypt Text' and copy the resulting authenticated payload for safe transport.
Practical Real-World Use Cases
Secure Communication over Untrusted Channels
Sharing sensitive credentials, passwords, or recovery codes across Slack, Discord, or email without plain text exposure.
Personal Offline Vault
Encrypting private journal entries, financial summaries, or backup keys before storing them in cloud drives or local text files.
Development Secret Sharing
Sharing staging database passwords and environment variables with team members using a shared verbal passphrase.
Frequently Asked Questions
- Can anyone decrypt my text without the passphrase?
- No. AES-GCM with a 256-bit key and 100,000 PBKDF2 iterations cannot be broken by modern computers without guessing the passphrase. Using a strong, high-entropy passphrase guarantees that your data remains mathematically secure.
- Are my plain text messages or passphrases saved on your servers?
- No. All encryption and decryption take place strictly in your browser's local memory. No plaintext, passphrase, or ciphertext is ever transmitted over the network.
- What happens if someone modifies the encrypted payload?
- Because AES-GCM uses an authenticated 128-bit tag, any alteration to the encrypted text will cause decryption to fail immediately with an authentication error, protecting you against tampering.
Share this tool
Help others discover this utility. No login or registration required.
Master this tool with Guides & Articles
Learn the workflows, common mistakes, and advanced techniques behind Text Encryption with our deep-dive educational content.