Text Encryption Tool (AES-256)

Real encryption, not a cipher toy

This tool encrypts text with AES-256-GCM, the same authenticated-encryption algorithm used to protect data in modern messaging apps and password managers — not a substitution cipher like ROT13 or Caesar that's meant for puzzles rather than actual security. Your passphrase never leaves your browser: everything runs through the Web Crypto API built into every modern browser, so no text or passphrase is ever transmitted to a server. Derive, encrypt, decrypt — it all happens locally on your device.

How to use it

• Switch to Encrypt mode, type or paste the text you want to protect, and choose a strong passphrase.
• Click Encrypt — you'll get a block of Base64 text that safely bundles the encrypted data along with the random salt and IV needed to decrypt it later.
• To read it back, switch to Decrypt mode, paste that Base64 block in, enter the exact same passphrase, and click Decrypt.
• Use 'Use as Decrypt Input' right after encrypting to instantly test that your passphrase round-trips correctly.

How the encryption actually works

Your passphrase alone isn't used as the encryption key directly — it's run through PBKDF2 (Password-Based Key Derivation Function 2) with 100,000 rounds of SHA-256 hashing and a random 16-byte salt, which is deliberately slow to make brute-force guessing impractical. That derived key then encrypts your text with AES-256 in GCM mode, which also authenticates the ciphertext — if even one character of the encrypted output is altered or corrupted, decryption will fail loudly instead of silently returning garbled text. A fresh random salt and IV (initialization vector) are generated every time you encrypt, so encrypting the same text twice with the same passphrase produces two completely different outputs.

Common questions

Is this actually secure, or just for fun?

It uses the same AES-256-GCM and PBKDF2 primitives found in production security software. The real-world security of any passphrase-based encryption still depends entirely on how strong and unguessable your passphrase is — use our Random Password Generator for inspiration if you want maximum strength.

What happens if I forget my passphrase?

The text is unrecoverable. There's no backdoor, no password reset, and no server-side copy — that's the entire point of client-side encryption. Store your passphrase somewhere safe before you close this tab.

Does any of my data get sent to a server?

No. Every operation — key derivation, encryption, decryption — runs in JavaScript inside your own browser using the built-in Web Crypto API. Nothing is uploaded anywhere.

Why does decryption fail even though I typed the right passphrase?

Double-check you copied the entire Base64 output, including the start and end — GCM mode intentionally fails decryption (rather than returning corrupted text) if even a single character of the ciphertext, salt, or IV is missing or wrong.

What's the difference between this and the Classic Cipher tool?

The Classic Cipher Tool implements historical ciphers (Caesar, ROT13, Atbash, Vigenère) that are easily broken with modern computing and exist mainly for puzzles, learning, and light obfuscation. This tool uses modern, computationally strong AES-256 encryption meant for actually protecting sensitive text.