How to use the encrypt and decrypt text (aes)
- Choose Encrypt text or Decrypt text.
- Type or paste the text, then enter a password. When encrypting, type it twice so a typo cannot lock you out.
- Press the button. The tool strengthens the password, which takes a moment, and shows the result.
- Copy the result. To decrypt, paste all of the text that starts with SPAES1. and use the same password.
What happens to your text
The tool uses AES-GCM with a 256-bit key through the WebCrypto API that is built into your browser. The key is made from your password with PBKDF2 and SHA-256, using 600,000 iterations and a random 16-byte salt. A random 12-byte value called an IV is made for each encryption. The salt and IV are stored at the start of the result, so only the password is needed to decrypt.
The result is the text SPAES1. followed by Base64 characters, which can be pasted into an email or a note. GCM also adds a 16-byte tag that detects changes, so if even one character of the encrypted text is altered, decryption fails with a clear message and not with garbage. Because the salt and IV are random, encrypting the same text twice gives different results.
What it cannot do
If you lose the password, the text cannot be recovered by anyone, including us. A weak password can be guessed by trying many candidates, so use a long one. The tool is for convenience. It is not a substitute for audited encryption software, and it does not protect text after it is decrypted on a device you do not control. It also does not hide that a message exists or who sent it.
Your password is never stored or sent. It stays in this tab until you press Clear everything or close the page. For related tools see the password generator, the hash generator, the Base64 encoder and the Caesar cipher, which is a classroom puzzle and offers no real protection.
Limits
Text can be up to 200,000 characters. Everything runs in your browser and nothing is uploaded. If the page cannot decrypt, it says the password is wrong or the text was changed or damaged, because those cases look the same by design.
Assumptions and limits
- AES-GCM, 256-bit key, PBKDF2 with SHA-256, 600,000 iterations, random salt and IV.
- Results start with SPAES1. and can only be decrypted with the same password.
- A lost password cannot be recovered.
- This tool is not a replacement for audited encryption software.
Frequently asked questions
How do I encrypt text with a password?
Choose Encrypt, enter your text and a password twice, and press Encrypt. Copy the result that starts with SPAES1. and keep the password safe.
What if I forget the password?
The text cannot be recovered. The key comes only from the password, and nothing is stored that could bring it back.
Why is the result different each time?
A new random salt and IV are made for every encryption, so the same text and password give a different result every time. All of them decrypt with the same password.
Why does decrypting fail?
Either the password is wrong, or the encrypted text was changed, cut short or damaged. The message cannot tell the two apart.
Is my text sent to a server?
No. Encryption and decryption run in your browser and neither the text nor the password leaves it.