AnyTool
Your files never leave your device. All processing happens locally in your browser.

How do I password-protect a file online without uploading it?

Open AnyTool's File Encryption tool, drop a file, set a password, and click Encrypt — it derives a key with Argon2id and encrypts the file with AES-256-GCM entirely in your browser, then you download a .enc file. To open it later, choose Decrypt and enter the same password. Files of any size work (encryption runs in authenticated chunks), the original filename is encrypted too, and nothing is ever uploaded.

  • Argon2id key derivation + AES-256-GCM (authenticated)
  • Any file size — chunked, runs in a Web Worker
  • Filename is encrypted; tampering/truncation is detected
  • 100% in your browser — no upload, no signup

What is

Client-side file encryption

Client-side file encryption scrambles a file in your browser using a password-derived key, so only someone with the password can read it and the file never leaves your device. Strong implementations use a memory-hard key-derivation function (Argon2id) and an authenticated cipher (AES-256-GCM) so wrong passwords and tampering are detected.

File Tools

Related terms

AES-256-GCMArgon2idpassword protectend-to-end encryptionzero-knowledge

How to Encrypt a File

Password-encrypt or decrypt a file entirely in your browser.

15 secWeb browser
  1. 1

    Choose a file

    Drop a file (or click to browse). For decryption, pick the .enc file.

  2. 2

    Set a password

    Enter a strong password (or generate one). Confirm it when encrypting.

  3. 3

    Encrypt / decrypt

    Click Encrypt or Decrypt, then download the result. Nothing is uploaded.

Result: An encrypted .enc file (or the recovered original)

Frequently Asked Questions

With AnyTool, yes — encryption happens in your browser and the file and password never leave your device.

There is no server: the key is derived with Argon2id and the file encrypted with AES-256-GCM locally, so neither the file nor the password is ever uploaded.

It cannot be recovered — there is no backdoor. Only the exact password can decrypt the file.

Because the key is derived from your password with Argon2id and never stored, a lost password means the file cannot be decrypted by anyone, including us.

Yes — files are encrypted in authenticated chunks in a Web Worker, so size is limited only by your device, not a fixed cap.

Unlike tools that cap at around 100 MB, the chunked AES-GCM design keeps memory bounded and handles large files; each chunk is authenticated so truncation or reordering is detected.

Detailed Explanation

Methodology

How the File Encryption Tool Works

AnyTool encrypts files entirely in the browser. A 256-bit key is derived from the password with Argon2id (a memory-hard KDF, run via hand-tuned WebAssembly), then the file is encrypted with AES-256-GCM from the Web Crypto API in independent ~1 MiB chunks — Web Crypto AES-GCM has no native streaming, so chunking keeps memory bounded and removes any fixed size limit. Each chunk uses a unique nonce (base nonce concatenated with a counter) and authenticates the header, the chunk index and a final-chunk flag as additional data, so wrong passwords, tampering, truncation and reordering all fail the GCM authentication tag. The original filename is written into an encrypted metadata chunk rather than in plaintext, and the container is a versioned, self-describing format. All of this runs in a Web Worker; nothing is ever uploaded.

  • Runs client-side — file and password never leave the device
  • Argon2id key derivation (memory-hard, GPU-resistant) via WebAssembly
  • AES-256-GCM authenticated encryption (Web Crypto API)
  • Chunked: any file size, bounded memory, real progress
  • Encrypted filename + tamper/truncation/reorder detection
  • Versioned self-describing container; no server, no CDN
Privacy & Security

Zero-Knowledge by Design

Because there is no backend, the tool is zero-knowledge: the password is never transmitted or stored, and the key exists only in memory during the operation. A lost password is unrecoverable — there is no backdoor — which is the expected property of genuine end-to-end encryption. It also works offline after first load.

File encryption: AnyTool vs other browser tools vs desktop apps
CapabilityAnyToolTypical online toolsDesktop apps
Key derivationArgon2id (memory-hard)Often PBKDF2 onlyArgon2id / scrypt
File sizeAny (chunked)Often capped (~100 MB)Any
Filename privacyEncryptedOften plaintextVaries
InstallNone — runs in browserNoneRequired
Data handlingNever uploadedUsually localLocal

AES-256-GCM provides authenticated encryption; chunk-level AAD adds truncation and reordering protection. Behaviour of other tools varies by service.