DevTools Logo

Text Encryptor

Text Encryptor

Encrypt and decrypt text with a passphrase using AES-256-GCM — 100% in your browser, nothing is sent or stored

Plaintext

Text to encrypt + a passphrase

Examples

Decrypt a deterministic AES-GCM fixture

Input
Ciphertext: AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaG2r01HbH2l4orjCvxLUsWu4zUKo2KhAW8eaVoMMnsg==
Passphrase: correct horse battery staple
Output
Secret message

This fixture uses the component's PBKDF2-SHA-256 parameters and salt|IV|ciphertext packing. Normal encryption output varies because the page generates random salt and IV bytes.

Decrypt a second UTF-8 fixture

Input
Ciphertext: ICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6O6CVzFC9k4K5KSvgAcDYLk5H5L9Oyjajg1C/+OA+ffzwJVJh
Passphrase: release-passphrase
Output
Deploy at 09:30 UTC

The first 16 decoded bytes are the salt, the next 12 are the IV, and the remaining bytes are authenticated AES-GCM ciphertext.

About this tool

Text Encryptor encrypts and decrypts text entirely in the browser with the Web Crypto API. It derives a non-exportable 256-bit AES-GCM key from the passphrase using PBKDF2 with SHA-256, a random 16-byte salt, and 250,000 iterations.

Each encryption creates a random 12-byte initialization vector. The output is one Base64 string containing salt, IV, and AES-GCM ciphertext with its authentication tag in that order, so the Decrypt tab can reconstruct the key parameters from the blob.

Because salt and IV are random, encrypting the same plaintext with the same passphrase produces different Base64 output. Successful decryption requires both the complete blob and the exact passphrase; a wrong passphrase or modified ciphertext fails authentication.

How to use

  1. Enter plaintext and a passphrase

    In the Encrypt tab, type the message and provide a strong passphrase that you can transfer separately.

  2. Encrypt and copy

    Select Encrypt and copy the Base64 salt|IV|ciphertext blob shown in the output field.

  3. Provide the blob for decryption

    Open Decrypt, paste the complete Base64 blob, and enter the exact passphrase used during encryption.

  4. Decrypt locally

    Select Decrypt to authenticate and recover the UTF-8 plaintext, or inspect the generic failure message if the input is wrong or damaged.

Use cases

Sharing a private text snippet

Encrypt a short message locally and transfer the Base64 blob separately from its passphrase.

Creating encrypted test fixtures

Exercise successful decryption, wrong-passphrase, malformed-Base64, and corrupted-ciphertext paths.

Protecting copied notes at rest

Store an authenticated ciphertext blob instead of readable plaintext when the passphrase is managed separately.

Demonstrating browser cryptography

Inspect a practical PBKDF2 key-derivation and AES-GCM packing workflow built on Web Crypto.

Common mistakes

Mistake:Losing the passphrase or expecting the tool to recover it.

Fix:Store the passphrase securely and separately; the blob contains the salt and IV but no passphrase or recovery mechanism.

Mistake:Comparing two ciphertext strings to decide whether their plaintext is equal.

Fix:Expect different output because every encryption uses a new random salt and IV, even for identical inputs.

Mistake:Editing, truncating, wrapping incorrectly, or partially copying the Base64 blob.

Fix:Preserve the complete salt|IV|ciphertext string; AES-GCM authentication rejects modified or incomplete data.

Mistake:Using a short, reused passphrase and assuming PBKDF2 creates missing entropy.

Fix:Choose a strong, unique passphrase and use an appropriate password manager or secret-sharing process.

Frequently asked questions

Related guides

Encrypting Files in the Browser: AES-256-GCM Without a Server

How client-side file encryption with PBKDF2 works, why wrong passwords fail loudly, and what a .dte file format contains.

How Text Becomes Bytes: Binary, Hex, and UTF-8 Explained

What happens when you save a text file, how UTF-8 encodes characters, and why the same string can be different lengths in binary.

Caesar Ciphers, ROT13, and Why Neither Is Encryption

What a shift cipher is, why ROT13 is self-inverse and useful for light obfuscation, and how frequency analysis breaks even large keys efficiently.

How BIP39 Seed Phrases Work (and Why You Must Never Reuse One)

The entropy-to-words mapping, the checksum, and the security model that makes a 12-word phrase protect an entire cryptocurrency wallet.

References & standards

Related tools

AES Encryption

Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.

Basic Auth Generator

Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.

Bcrypt Generator & Verifier

Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.

BIP39 Mnemonic Generator

Generate and validate BIP39 seed phrases locally for testing

Checksum Calculator

Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API

Client-Side File Encryptor

Encrypt any file with AES-256-GCM and PBKDF2 directly in your browser — no uploads, no accounts, wrong passwords fail loudly.