Text Encryption (AES-256)

Text encryption: protect a message with AES-GCM locally

Protect a note or other text with a password you choose. Select Encrypt, paste your plaintext and enter the password. Processing starts only when you click Run. The result is a string beginning with ST1:. Copy the entire string and save it yourself, for example in a text file. Your text can include accented characters and line breaks. No account is required. To read the result later, you need this string and the exact password.

Encrypting and reading your text again

Choose Decrypt and paste the complete ST1 string into the text field. Enter the same password, including its original capitalization and spaces. Do not edit the encrypted text or add line breaks. If copying removes characters, the tool cannot repair the missing data. Test decryption before deleting your only plaintext copy. Keep a backup of the encrypted result where you can find it later.

A wrong password and changed data produce the same error message. The tool cannot reliably distinguish those causes. Without the correct password, there is no reset link or recovery service. Send the password through a separate channel rather than alongside the encrypted message. The Password Generator and Passphrase Generator can help you create a new secret rather than reusing an account password.

The encryption method and ST1 format

The browser Web Crypto API performs AES-GCM encryption with a 256-bit key. PBKDF2 derives that key from your password using SHA-256 and 210,000 iterations. Every encryption generates a fresh random 16-byte salt and a fresh 12-byte initialization vector. Encrypting identical text with the same password therefore produces different strings. This variation is intentional; it does not mean that your text changed.

After the ST1: prefix, Base64 encodes the salt, initialization vector and ciphertext, including the 128-bit authentication tag. The salt and initialization vector are not secret. The tag allows decryption to detect changes. Base64 alone provides no protection. ST1 is the format used by this tool, not a universal file format for encryption software. By contrast, the Hash Generator produces checksums. A hash cannot be decrypted back into your original text.

Limits of password protection

A short or commonly used password remains vulnerable. Anyone who has the encrypted string can try password guesses without using this website. Choose a long, unique secret. AES-GCM does not make message delivery anonymous or establish the identity of a sender. This tool encrypts text, not entire folders or arbitrary files. Very large inputs can put pressure on browser memory. An available Web Crypto API is required, normally in a current browser over HTTPS.

The tool code processes everything locally and sends no text, password or result to a server. Encryption still cannot protect against malware or a browser extension reading the page. Your clipboard and any plaintext copy you save are also potential weak points. Use a device you trust when handling sensitive information.

Frequently asked questions