Encrypt and Decrypt Text

Password-protect a message with AES-256 — encrypted and decrypted in your browser.

Stays on your device. This tool runs in your browser — nothing you paste or open ever leaves it. Nothing uploaded, nothing to leak.

Mode

Password

AES-256-GCM · runs in your browser, never sent

Result

Help us improve Was this tool useful? Tap a star. Thanks — your rating helps others find it.

Be the first to rate

How to encrypt a message

Type or paste your text, choose a password, and press Encrypt. You get a single block of encrypted text to copy. Send that block however you like, and share the password by a different route — a text message or a call, not the same email. To read it, the recipient pastes the block in, switches to Decrypt, enters the password and gets the original back.

Encrypt Text — TechWhack Score

9.3/10

Privacy 10/10

The message and the password are handled entirely in your browser by the Web Crypto API — neither is ever transmitted.
Speed 9/10

Near-instant, though the 250,000-round key derivation adds a deliberate moment.
Features 8/10

AES-256-GCM with PBKDF2-SHA-256 key derivation, a fresh random salt and IV per message, and tamper detection built in.
Free 10/10

No sign-up, no message-length limit, embeddable.

Verdict: Authenticated encryption with proper key stretching, done locally — a tampered block fails to decrypt rather than returning quiet nonsense.

Embed this tool on your site

<iframe src="https://techwhack.com/tools/security/encrypt-decrypt-text/embed" width="100%" height="440" frameborder="0" loading="lazy"></iframe>
<!-- Powered by TechWhack -->

This tool encrypts a piece of text with a password so only someone who knows that password can read it. It uses AES-256-GCM, with the key derived from your password by PBKDF2-SHA-256 over 250,000 iterations, and a fresh random salt and IV every time. Encrypting gives you one block of text to send; pasting that block back with the same password returns the original. It all runs in your browser — neither the message nor the password is ever transmitted.

What the encryption actually does

AES-256-GCM is an authenticated cipher, which means it not only hides the contents but detects tampering — if a single character of the encrypted block is altered, decryption fails rather than returning corrupted text. Your password is not used as the key directly; PBKDF2 stretches it over 250,000 rounds with a random salt, which makes guessing passwords far slower for an attacker. The salt and IV are stored alongside the ciphertext, so you only need to keep the one block.

What it is not

The security rests entirely on your password — a short or reused one can be guessed no matter how strong the cipher is. This is intended for sending a note or a snippet safely, not as a substitute for a password manager, full-disk encryption, or end-to-end encrypted messaging. Nothing is stored here, so a lost password means the text cannot be recovered by us or anyone else.

FAQ

Is my text or password sent to a server?No. Encryption and decryption run entirely in your browser using the built-in Web Crypto API. Nothing is uploaded, logged or stored.

What encryption is used?AES-256-GCM, with the key derived from your password via PBKDF2-SHA-256 over 250,000 iterations and a random salt and IV each time.

Can I recover the text if I forget the password?No. There is no key escrow and nothing is stored — without the password the text cannot be recovered by anyone, including us.