How the Text Encryptor Works
AnyTool Text Encryptor performs real authenticated encryption in the browser with the Web Crypto API. A random 16-byte salt is generated, then PBKDF2 (HMAC-SHA-256, a configurable iteration count) stretches the password into a 256-bit AES key. The plaintext is encrypted with AES-256-GCM using a fresh random 12-byte IV, and the 16-byte GCM authentication tag is appended. The output is a single self-contained payload — base64 of salt, IV and ciphertext-plus-tag — so decryption needs only the password and the payload.
- AES-256-GCM authenticated encryption, not an XOR or substitution cipher
- PBKDF2-HMAC-SHA-256 key derivation over a per-message random salt
- Random 12-byte IV per encryption; 16-byte GCM tag detects tampering
- Payload layout: base64( salt(16) ‖ IV(12) ‖ ciphertext+tag )
- Salt, IV and key generated with crypto.getRandomValues — all client-side
Passwords, Key Stretching and Strength
Because the cipher is strong, the realistic attack is guessing the password, so the tool slows that down and helps users choose better passwords. PBKDF2 iterations are adjustable (OWASP recommends 600,000 or more for SHA-256) and are stored in the payload so any setting still decrypts. A strength meter uses the same pattern-aware estimate as the Password Strength Checker (common passwords, dictionary words, l33t swaps, keyboard walks, dates and repeats), and a one-click generator produces strong random passwords with crypto.getRandomValues.
- Adjustable PBKDF2 iterations; the count is encoded in the payload
- Strength meter estimates entropy in bits and flags weak or common passwords
- Built-in generator creates strong random passwords, ambiguous characters excluded
- A wrong password or altered payload fails GCM authentication with a clear error
- Optional PEM-like armor wrapper for easy pasting into email or chat
Privacy and Honest Limitations
All key derivation and encryption happen locally, so the password and text never reach a server and the page works offline. The tool is deliberately honest about scope: this is genuine AES-256-GCM, but overall security still depends on password strength, and there is no recovery if a password is lost — no backdoor, reset or key escrow. Sharing the password over a separate channel from the encrypted text is recommended.
