cosmodev ~/tools/text-encryptor

AES-256-GCM · 100% client-side

Plaintext

Derives a key with PBKDF2 (100,000 iterations). The password never leaves this page and is never put in the share link.

Encrypted (Base64)

Enter text and a password, then press Encrypt.

cosmodev ~/docs/text-encryptor.md

What it does

The Text Encryptor locks any text with a password using AES-256-GCM, the same authenticated encryption standard used by TLS and full-disk encryption. Paste a message, choose a password, and you get a compact

Base64Base64An encoding representing binary data as 64 safe ASCII characters, so it survives transport through text-only channels. It encodes — it does not encrypt.

ciphertext you can store anywhere or send over any channel - email, chat, a ticket. Only someone who knows the password can turn it back into readable text.

The key is derived from your password with PBKDF2 (SHA-256, 100,000 iterations, fresh 16-byte

saltsaltRandom data mixed into each password before hashing, so identical passwords produce different digests and precomputed tables become useless.

every time), so identical messages never produce identical ciphertext, and dictionary attacks are slowed by design. Everything runs 100% client-side in your browser: neither the text nor the password is ever sent to a server.

How to use it

Pick a mode with the Encrypt / Decrypt toggle (top left).
Type or paste your text into the input box - plaintext when encrypting,
Base64Base64An encoding representing binary data as 64 safe ASCII characters, so it survives transport through text-only channels. It encodes — it does not encrypt.
ciphertext when decrypting.
Enter a password. Use the eye button to show or hide it.
Press Encrypt (or Decrypt). The result appears in the output box with a Copy button.
After encrypting, press Share ciphertext link to copy a URL that carries the ciphertext (never the password).

Examples

Encrypt a secret

Input: Meet me at the airlock at 21:00 with password reactor-key

Output (varies every run - fresh

saltsaltRandom data mixed into each password before hashing, so identical passwords produce different digests and precomputed tables become useless.

and IV each time):

Q5xJ0mF3nM2c0kqTzZLBM1rsRXd6lt4+pQa2S/yVzpvxv1CVKJnOGh3tWlFcT9m+HGM=

Decrypt it back

Switch to Decrypt, paste the

Base64Base64An encoding representing binary data as 64 safe ASCII characters, so it survives transport through text-only channels. It encodes — it does not encrypt.

string, enter reactor-key → Meet me at the airlock at 21:00.

Wrong password

Paste the same ciphertext with password wrong-key → Decryption failed - wrong password or corrupted ciphertext.

Good to know

Authenticated: AES-GCM adds a 16-byte authentication tag, so tampered ciphertext is detected and rejected instead of decrypting to garbage.
Format: the
Base64Base64An encoding representing binary data as 64 safe ASCII characters, so it survives transport through text-only channels. It encodes — it does not encrypt.
output packs salt (16B) + IV (12B) + ciphertext + tag - a self-contained string, no side-channel metadata needed.
Private: runs 100% client-side - safe for secrets. The share link contains only the ciphertext, never the password; send the password through a different channel.
Related tools: Password Generator (pick a strong one),
HashHashA one-way function that maps data of any size to a fixed-length digest. Same input, same digest; any change, different digest; not reversible.
Generator,
Base64Base64An encoding representing binary data as 64 safe ASCII characters, so it survives transport through text-only channels. It encodes — it does not encrypt.
Encode / Decode.