DevTools Logo

Client-Side File Encryptor

Client-Side File Encryptor

AES-256-GCM file encryption with PBKDF2 — the key and the file never leave your device

File & password

Operation

Result

Pick a file, enter a password and run — the result appears here.

How it protects you

  • AES-256-GCM authenticated encryption — tampering fails loudly
  • PBKDF2-SHA256 with 250,000 iterations
  • Random 16-byte salt and 12-byte IV per file
  • Self-describing .dte format: magic header + salt + IV + ciphertext

Encryption runs entirely in your browser using the Web Crypto API. The password and the file contents never leave your device — but that also means a lost password cannot be recovered.

Examples

Cloud hardening

Input
tax-return.pdf · passphrase from a password manager
Output
tax-return.pdf.dte — ciphertext only in the sync folder

The provider stores bytes it cannot read; share the passphrase by a different channel.

About this tool

Real cryptography, zero servers: AES-256-GCM authenticated encryption with a PBKDF2-SHA256 key stretched at 250,000 iterations, a fresh 16-byte salt and 12-byte IV per file. The Web Crypto engine in your browser does the work; the file and password never leave the tab.

Encrypted files are self-describing .dte containers (magic header + salt + IV + ciphertext with GCM tag), so decryption needs nothing but the password. Authentication means a wrong password or a flipped bit fails loudly — never silent corruption.

How to use

  1. Pick a file

    Anything local; the tool flags files that already look pre-encrypted.

  2. Set a strong passphrase

    Type and confirm — there is no recovery mechanism by design.

  3. Encrypt

    Download the .dte file; nothing was uploaded at any point.

  4. Decrypt later

    Switch modes, pick the .dte, re-enter the same password, download the original.

Use cases

Cloud backups

Encrypt sensitive documents before they sync to shared storage.

Safe attachments

Send ciphertext by email; deliver the password by voice or messenger.

Cryptographic parameters

ParameterValue
CipherAES-256-GCM (authenticated)
Key derivationPBKDF2-SHA256, 250,000 iterations
Salt / IV16 bytes / 12 bytes, random per file
ContainerDTE1 magic + salt + IV + ciphertext + GCM tag

Common mistakes

Mistake:Reusing an everyday password

Fix:The passphrase is the entire security model — generate and store one properly.

Mistake:Losing the password and expecting recovery

Fix:No escrow exists by design; a password manager entry prevents the tragedy.

Frequently asked questions

Related guides

Burn Notes: How to Share a Secret That Deletes Itself

One-time encrypted links explained: why the decryption key lives in the URL fragment, what 'burn after reading' really guarantees, and what it doesn't.

References & standards

Related tools

AES Encryption

Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.

Basic Auth Generator

Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.

Bcrypt Generator & Verifier

Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.

BIP39 Mnemonic Generator

Generate and validate BIP39 seed phrases locally for testing

Checksum Calculator

Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API

CORS Header Validator

Validate Cross-Origin Resource Sharing headers for security compliance