Text Encryptor

How do I encrypt and decrypt text with a password online?

Type or paste your message into AnyTool Text Encryptor, choose a strong password and click Encrypt. It derives a key from your password with PBKDF2 (HMAC-SHA-256) over a random salt and seals the text with AES-256-GCM using a random IV, producing one self-contained payload you can copy or download. To read it back, switch to Decrypt, paste the payload and enter the same password. Everything runs in your browser via the Web Crypto API, so your password and text are never uploaded.

Real AES-256-GCM authenticated encryption, not a toy cipher
PBKDF2-SHA-256 key stretching over a random salt, with adjustable iterations
Self-contained payload — base64 of salt, IV and ciphertext — or a PEM-like armor block
Password strength meter, show/hide and a strong-password generator
A wrong password or any tampering fails with a clear message — 100% client-side

What is

A text encryptor is a tool that converts a readable message into ciphertext using a secret password, so only someone with that password can recover the original. A modern one derives an encryption key from the password with a slow key-derivation function such as PBKDF2 and encrypts with an authenticated cipher such as AES-256-GCM, which both hides the text and detects tampering.

Text Tools

Related terms

AES-256-GCMPBKDF2Web Crypto APIEnd-to-End EncryptionAuthenticated Encryption

Frequently Asked Questions

The tool uses the standard Web Crypto API to derive a 256-bit key from your password with PBKDF2 (HMAC-SHA-256) over a random salt, then encrypts with AES-256 in GCM mode, an authenticated cipher that also detects tampering. These are the same building blocks used by reputable password managers. The one limit is your password: a short or common password can be brute-forced no matter how strong the cipher, so use a long, random passphrase.

It is genuine AES-256-GCM with PBKDF2 key stretching via the browser Web Crypto API — real cryptography, not XOR. Security still depends on your password.

There is no server, no account and no tracking. The key derivation and AES-GCM encryption run entirely in your browser using the Web Crypto API, the salt and IV are generated locally with crypto.getRandomValues, and the page works offline after first load — so you can safely encrypt confidential notes, recovery codes or messages.

No. All encryption and decryption happen in your browser, so your text and password never leave your device and it works offline.

Strong password-based encryption is only useful because nobody, including us, can decrypt without the password. We never see it and store nothing, so there is no recovery path. Keep the password in a safe place such as a password manager, and remember that capitalisation and spacing must match exactly to decrypt.

The text cannot be recovered. There is no backdoor, reset or key escrow — without the exact password the ciphertext is unreadable.

Copy or download the encrypted output and send it however you like — email, chat or a file. Tell the recipient the password through a different channel, for example a phone call or a separate app, so an attacker who intercepts the message still cannot read it. The recipient pastes the payload into Decrypt and enters the password to recover the original text.

Send them the encrypted payload, then share the password separately over a different channel — never in the same message.

Detailed Explanation

Methodology

How the Text Encryptor Works

AnyTool Text Encryptor performs real authenticated encryption in the browser with the Web Crypto API. A random 16-byte salt is generated, then PBKDF2 (HMAC-SHA-256, a configurable iteration count) stretches the password into a 256-bit AES key. The plaintext is encrypted with AES-256-GCM using a fresh random 12-byte IV, and the 16-byte GCM authentication tag is appended. The output is a single self-contained payload — base64 of salt, IV and ciphertext-plus-tag — so decryption needs only the password and the payload.

AES-256-GCM authenticated encryption, not an XOR or substitution cipher
PBKDF2-HMAC-SHA-256 key derivation over a per-message random salt
Random 12-byte IV per encryption; 16-byte GCM tag detects tampering
Payload layout: base64( salt(16) ‖ IV(12) ‖ ciphertext+tag )
Salt, IV and key generated with crypto.getRandomValues — all client-side

How It Works

Passwords, Key Stretching and Strength

Because the cipher is strong, the realistic attack is guessing the password, so the tool slows that down and helps users choose better passwords. PBKDF2 iterations are adjustable (OWASP recommends 600,000 or more for SHA-256) and are stored in the payload so any setting still decrypts. A strength meter estimates entropy from character-class size and length, penalising common and repetitive passwords, and a one-click generator produces strong random passwords with crypto.getRandomValues.

Adjustable PBKDF2 iterations; the count is encoded in the payload
Strength meter estimates entropy in bits and flags weak or common passwords
Built-in generator creates strong random passwords, ambiguous characters excluded
A wrong password or altered payload fails GCM authentication with a clear error
Optional PEM-like armor wrapper for easy pasting into email or chat

Privacy & Security

Privacy and Honest Limitations

All key derivation and encryption happen locally, so the password and text never reach a server and the page works offline. The tool is deliberately honest about scope: this is genuine AES-256-GCM, but overall security still depends on password strength, and there is no recovery if a password is lost — no backdoor, reset or key escrow. Sharing the password over a separate channel from the encrypted text is recommended.

Text encryption: in-browser AES (AnyTool) vs typical online encryptors
Capability	AnyTool	Typical online encryptors
Cipher	AES-256-GCM (authenticated)	Often XOR or unspecified
Key derivation	PBKDF2-SHA-256, salted	Sometimes raw or unsalted
Processing	In your browser (Web Crypto)	Often posted to a server
Password / text privacy	Never leaves device	May be logged server-side
Tamper detection	Yes, via GCM tag	Usually none
Works offline	Yes (PWA)	No
Cost / signup	Free, no signup	Often ad-heavy or gated

Many “online encryptors” use weak or server-side ciphers; AnyTool runs standard AES-256-GCM with PBKDF2 locally and uploads nothing.