Your files never leave your device. All processing happens locally in your browser.
How do I encrypt and decrypt text in the browser — and which cipher is actually secure?
Open the Cryptography Suite and pick an algorithm. For real protection use the default, AES-256-GCM: enter a passphrase and your text and it produces one self-contained, authenticated base64 token using the browser’s Web Crypto API — a PBKDF2-HMAC-SHA-256 key over a random salt and a random 12-byte IV; paste the token back with the same passphrase to decrypt. The other algorithms — Blowfish (ECB/CBC), RC4, repeating-key XOR, Vigenère, Caesar and ROT13 — are provided ONLY for interoperability with old systems and for learning, each behind a loud “insecure” banner, because they are broken or trivially crackable. Everything runs locally on your device; your text and keys are never uploaded. Only AES-256-GCM is authenticated, so only it can tell you when the passphrase is wrong — the legacy ciphers just return garbage.
AES-256-GCM (the default) is real, authenticated encryption via Web Crypto — the one to use
PBKDF2-HMAC-SHA-256 passphrase key, random salt + IV, one self-contained base64 token
Legacy ciphers (Blowfish, RC4, XOR, Vigenère, Caesar, ROT13) are for interop / learning only
Blowfish is correctly implemented and matches the official test vectors, but is legacy (64-bit block)
100% client-side — nothing is uploaded, and a lost passphrase is unrecoverable
What is
Symmetric cipher
A symmetric cipher encrypts and decrypts with the same secret key. Modern ones like AES-256-GCM are authenticated block ciphers: they combine confidentiality with an integrity tag so any tampering or a wrong key is detected, and they derive the key from a passphrase with a slow key-stretching function such as PBKDF2 to resist brute force. Classical and legacy ciphers — a Caesar shift, the Vigenère polyalphabetic cipher, repeating-key XOR, the RC4 stream cipher and even the real Blowfish block cipher — use the same key to encrypt and decrypt but are broken or trivially crackable today (small key spaces, biased keystreams, no authentication, or a 64-bit block vulnerable to birthday attacks), so they survive only for interoperability with old systems and for teaching how cryptanalysis works. A client-side cryptography suite runs all of this in the browser with the Web Crypto API and pure JavaScript, so keys and plaintext never leave the device.
No. All encryption and decryption run entirely in your browser — your text, keys and the resulting output are never uploaded, logged or stored on a server.
The Cryptography Suite is 100% client-side. AES-256-GCM uses the browser’s built-in Web Crypto API (window.crypto.subtle) with secure randomness from crypto.getRandomValues, and the legacy ciphers run in a pure in-browser engine; there is no upload, no server and no CDN anywhere in the processing path. Nothing is persisted, so closing the tab erases everything, and the tool works offline once cached. Because your data never leaves your machine, it is safe in a way an online encryption service — which would receive your plaintext and passphrase — can never be. The only optional network use anywhere on the site is consent-gated ads, which never see your text.
AES-256-GCM — the default. It is real, standard, authenticated encryption. The other ciphers are broken and are only for interop or learning.
Use AES-256-GCM for anything real. It is AES-256 in Galois/Counter Mode, an authenticated cipher whose 128-bit tag detects any tampering or a wrong passphrase, with your passphrase stretched into a 256-bit key by PBKDF2-HMAC-SHA-256 over a fresh random 16-byte salt and encrypted under a random 12-byte IV. RC4 has a biased keystream and is banned from TLS (RFC 7465); repeating-key XOR and Vigenère fall instantly to Kasiski examination and frequency analysis; Caesar and ROT13 have at most 25 keys. Blowfish is a genuine, correctly-implemented 16-round Feistel cipher, but its 64-bit block exposes it to the Sweet32 birthday attack (CVE-2016-2183) and it is legacy. Reach for the legacy options only to read data produced by an old system, or to learn how ciphers are broken.
Because we will not ship broken crypto. We only include ciphers we can implement correctly without a heavyweight library; a vetted DES / 3DES is not bundled, so it is omitted honestly.
The suite deliberately omits DES, Triple-DES and other named ciphers for which a correct, audited implementation is not bundled. Shipping a hand-rolled or approximate version that produces non-standard output would be worse than not offering it — it would fail to interoperate and could give a false sense of security. Everything that is included is named with its real standard and, where it matters, verified: the Blowfish here is checked against the official Blowfish test vectors, and AES-256-GCM and PBKDF2 use the browser’s own Web Crypto implementation (the same primitives that back TLS). If you need 3DES for a legacy system, use a dedicated, audited tool.
Only AES-256-GCM can — it is authenticated and refuses to decrypt on a wrong passphrase. The legacy ciphers are unauthenticated and just return garbage.
AES-256-GCM carries a 128-bit authentication tag, so a wrong passphrase or any change to even one byte of the token causes decryption to be refused rather than returning altered text — a real integrity guarantee. None of the legacy ciphers (Blowfish ECB/CBC, RC4, XOR, Vigenère, Caesar, ROT13) are authenticated: with the wrong key they silently produce meaningless output, and an attacker can flip bits without detection. Blowfish’s PKCS#7 padding check gives only a weak hint that the key is wrong. This is one more reason to use AES-256-GCM for anything you actually care about, and to treat the legacy ciphers as interop and teaching tools only.
Detailed Explanation
📖How It Works
What the Cryptography Suite Does
This tool encrypts and decrypts text in the browser with a deliberate split between SECURE and LEGACY algorithms. The default and recommended choice is real AES-256-GCM: you enter a passphrase and some text, and it returns one self-contained, authenticated base64 token you can decrypt later with the same passphrase. Alongside it sit classic and legacy ciphers — Blowfish in ECB and CBC modes, the RC4 stream cipher, repeating-key XOR, the Vigenère polyalphabetic cipher, a Caesar shift and ROT13 — each shown behind a loud “insecure” banner and offered only for interoperability with old systems and for learning. A single page groups the algorithms Secure vs Legacy, toggles encrypt/decrypt, takes a key or passphrase, outputs base64 or hex, and explains each algorithm inline.
Secure default: authenticated AES-256-GCM via the Web Crypto API
Every legacy cipher carries a prominent insecure banner
Per-algorithm explanation with its standard named
⚙️Methodology
How AES-256-GCM Encryption Works Here
The secure path reuses an audited engine (textCryptoEngine.ts) built on the browser’s Web Crypto API. A fresh random 16-byte salt is generated per message; PBKDF2-HMAC-SHA-256 (210,000 iterations by default) stretches the passphrase over that salt into a 256-bit AES key; and the UTF-8 plaintext is encrypted with AES-256-GCM under a fresh random 12-byte IV. GCM is authenticated, so the 128-bit tag detects any tampering or a wrong passphrase and refuses to return altered plaintext. The output is one base64 token — version, iteration count, salt, IV and ciphertext-plus-tag concatenated — so decryption needs nothing but the token and the passphrase. All randomness comes from crypto.getRandomValues, never Math.random.
Random 16-byte salt per message; PBKDF2-HMAC-SHA-256, 210k iterations
AES-256-GCM with a random 12-byte IV and a 128-bit authentication tag
Self-contained token: version ‖ iterations ‖ salt ‖ IV ‖ ciphertext+tag
Authenticated: a wrong passphrase or altered byte is rejected, not decrypted
Secure randomness via crypto.getRandomValues
🔧Technical Details
The Legacy Ciphers, Implemented Correctly
The legacy ciphers live in a pure engine (cryptoSuiteEngine.ts). Blowfish is a genuine 16-round Feistel block cipher: its P-array and four S-boxes are initialised from the hexadecimal fractional digits of π (generated and verified against the documented anchors P[0]=0x243f6a88 … S3[255]=0x3ac372e6), and the implementation is checked against the official Blowfish test vectors (key/plaintext all-zero → 0x4ef997456198dd78). It runs in ECB or CBC (a random 8-byte IV is prepended for self-containment) with PKCS#7 padding. RC4 is the standard key-scheduled stream cipher, verified against its public test vectors; XOR is a repeating-key cipher over raw bytes; Vigenère, Caesar and ROT13 are the classical letter ciphers. Byte ciphers output hex or base64; the classical letter ciphers output readable text.
Blowfish S-boxes from π; verified against the official Blowfish test vectors
Blowfish ECB and CBC (random 8-byte IV prepended) with PKCS#7 padding
RC4 verified against its published keystream test vectors
Repeating-key XOR over bytes; Vigenère / Caesar / ROT13 over letters
Byte ciphers → hex/base64; classical ciphers → readable text
⚠️Limitations
Honest Limitations
Only AES-256-GCM here is secure. RC4’s keystream is statistically biased and it is banned from TLS (RFC 7465); repeating-key XOR and Vigenère fall immediately to Kasiski examination and frequency analysis; Caesar and ROT13 have at most 25 keys and are crackable by hand. Blowfish is correct and interoperable but legacy: its 64-bit block is vulnerable to the Sweet32 birthday attack (CVE-2016-2183) on large volumes of data. None of the legacy ciphers are authenticated, so with a wrong key they silently return garbage rather than an error, and an attacker can alter ciphertext undetected. We deliberately do NOT ship DES / Triple-DES or other ciphers we cannot bundle a vetted implementation of, because broken crypto is worse than none. Even with AES, security depends entirely on your passphrase (a weak one is brute-forceable), a lost passphrase is unrecoverable, and browser JavaScript cannot reliably wipe secrets from memory. For high-stakes or regulated data use audited, purpose-built software (GnuPG, age, a vetted password manager).
RC4, XOR, Vigenère, Caesar, ROT13 are broken / trivially crackable
Blowfish is legacy — 64-bit block, Sweet32 (CVE-2016-2183)
Legacy ciphers are unauthenticated: a wrong key returns garbage, not an error
DES / Triple-DES are omitted rather than shipped unvetted
AES is only as strong as the passphrase; a lost passphrase is unrecoverable
🔒Privacy & Security
Private by Design
Everything happens on your device. AES-256-GCM runs on the browser’s native Web Crypto API with randomness from crypto.getRandomValues, and the legacy ciphers run in a pure in-browser engine; there is no upload, no server, no CDN and no telemetry anywhere in the processing path. Because your text and keys never leave your machine, this is safe in a way an online encryption service — which would receive your plaintext and passphrase — can never be. Nothing is persisted, so closing the tab erases everything, and the tool works offline once cached. The only optional network use anywhere on the site is consent-gated ads, which never see your text.
AES via native Web Crypto; legacy ciphers in a pure in-browser engine
No upload, server, CDN or telemetry in the path
Safe for real secrets, unlike an online encryption service
Nothing persisted — closing the tab erases everything; works offline
Only optional network use is consent-gated ads that never see your text
Which cipher to use
Algorithm
Type
Secure today?
Use for
AES-256-GCM
Authenticated block cipher (Web Crypto)
Yes — the one to use
Actually protecting real data
Blowfish (ECB/CBC)
64-bit Feistel block cipher
No — legacy (Sweet32)
Interop with old Blowfish systems
RC4
Stream cipher
No — broken, banned from TLS
Reading old RC4-encrypted data
XOR / Vigenère
Repeating-key substitution
No — trivially crackable
Learning cryptanalysis
Caesar / ROT13
Fixed alphabet shift
No — ≤25 keys, no security
Puzzles, spoilers, teaching
Only AES-256-GCM is secure; the rest are for interoperability and learning only, each behind an insecure banner. DES / Triple-DES are omitted rather than shipped unvetted. Everything runs locally in the browser. As of July 2026.
