Derives a key with PBKDF2 (100,000 iterations). The password never leaves this page and is never put in the share link.
Voer tekst en een wachtwoord in en druk op Versleutelen.
(Documentatie in het Engels)
What it does
The Text Encryptor locks any text with a password using AES-256-GCM, the same authenticated encryption standard used by TLS and full-disk encryption. Paste a message, choose a password, and you get a compact
Base64Base64An encoding representing binary data as 64 safe ASCII characters, so it survives transport through text-only channels. It encodes — it does not encrypt.
ciphertext you can store anywhere or send over any channel - email, chat, a ticket. Only someone who knows the password can turn it back into readable text.The key is derived from your password with PBKDF2 (SHA-256, 100,000 iterations, fresh 16-byte
saltsaltRandom data mixed into each password before hashing, so identical passwords produce different digests and precomputed tables become useless.
every time), so identical messages never produce identical ciphertext, and dictionary attacks are slowed by design. Everything runs 100% client-side in your browser: neither the text nor the password is ever sent to a server.How to use it
- Pick a mode with the Encrypt / Decrypt toggle (top left).
- Type or paste your text into the input box - plaintext when encrypting,
Base64Base64An encoding representing binary data as 64 safe ASCII characters, so it survives transport through text-only channels. It encodes — it does not encrypt.
ciphertext when decrypting. - Enter a password. Use the eye button to show or hide it.
- Press Encrypt (or Decrypt). The result appears in the output box with a Copy button.
- After encrypting, press Share ciphertext link to copy a URL that carries the ciphertext (never the password).
Examples
Encrypt a secret
Input: Meet me at the airlock at 21:00 with password reactor-key
Output (varies every run - fresh
saltsaltRandom data mixed into each password before hashing, so identical passwords produce different digests and precomputed tables become useless.
and IV each time):Q5xJ0mF3nM2c0kqTzZLBM1rsRXd6lt4+pQa2S/yVzpvxv1CVKJnOGh3tWlFcT9m+HGM=Decrypt it back
Switch to Decrypt, paste the
Base64Base64An encoding representing binary data as 64 safe ASCII characters, so it survives transport through text-only channels. It encodes — it does not encrypt.
string, enterreactor-key → Meet me at the airlock at 21:00.
Wrong password
Paste the same ciphertext with password wrong-key → Decryption failed - wrong password or corrupted ciphertext.
Good to know
- Authenticated: AES-GCM adds a 16-byte authentication tag, so tampered ciphertext is detected and rejected instead of decrypting to garbage.
- Format: the
Base64Base64An encoding representing binary data as 64 safe ASCII characters, so it survives transport through text-only channels. It encodes — it does not encrypt.
output packssalt (16B) + IV (12B) + ciphertext + tag- a self-contained string, no side-channel metadata needed. - Private: runs 100% client-side - safe for secrets. The share link contains only the ciphertext, never the password; send the password through a different channel.
- Related tools: Password Generator (pick a strong one),
HashHashA one-way function that maps data of any size to a fixed-length digest. Same input, same digest; any change, different digest; not reversible.
Generator,Base64Base64An encoding representing binary data as 64 safe ASCII characters, so it survives transport through text-only channels. It encodes — it does not encrypt.
Encode / Decode.