AES Text Encryption
Encrypt or decrypt text with a password using AES-256-GCM. Share the result safely — only someone with the password can read it. Everything is computed in your browser with the Web Crypto API.
New to this? Read the AES encryption guide →
AES-256-GCM with a PBKDF2-SHA256 key (250,000 iterations). Encryption runs in your browser with the Web Crypto API — your text and password are never uploaded. There is no password recovery: if you lose the password, the text cannot be decrypted.
How to use AES text encryption
- Type or paste the text you want to protect and choose a strong password.
- Press encrypt. You get a block of ciphertext that is safe to send or store.
- To read it back, paste the ciphertext and enter the same password, then press decrypt.
Everything runs in your browser with the Web Crypto API, so your text and password never leave your device. There is no recovery: if the password is lost, the text cannot be decrypted.
What "encrypted" really means here
This is real encryption, not encoding. The text is scrambled with AES-256-GCM using a key derived from your password, so without the password the ciphertext is meaningless. That is different from Base64, which has no key and can be decoded by anyone. If your goal is secrecy, you want encryption like this; if you only need to move binary safely through a text channel, that is what Base64 is for.
Sharing a secret safely
A good pattern for sending a password or note to a colleague: encrypt it here, send the ciphertext over one channel (email, chat, a ticket), and share the password over a different channel (a call or a separate app). A leak of either channel alone then reveals nothing. For the full approach, see how to share a password securely.
Frequently asked questions
Is the encryption secure?
Yes. It uses AES-256-GCM — the same authenticated cipher trusted for government and banking data — with a key derived from your password using PBKDF2-SHA256 over 250,000 iterations. The strength then depends on your password, so use a long, random one.
Is my text or password uploaded?
No. Encryption and decryption happen entirely in your browser with the Web Crypto API. Your text and password never leave your device, and nothing is stored.
I lost my password — can I still decrypt?
No. There is no backdoor or recovery: without the exact password the ciphertext cannot be decrypted. Keep the password safe, ideally in a password manager.
Where you'd use this
Protecting a short piece of text you have to send through a channel you do not trust — a note in a ticket, a value in a shared document — where the recipient can be given the passphrase separately.
For example: You need to pass a database connection string to a contractor over Slack. Encrypting it with AES-256-GCM and sharing the passphrase by phone means the Slack message alone is useless to anyone who later gains access to the workspace.