Text Encryptor & Decryptor
Encrypt any text with a password using AES-256-GCM, then decrypt it again later — free, private, and fully client-side.
Text Encryptor & Decryptor encrypts and decrypts text with AES-256-GCM authenticated encryption directly in your browser. A password-derived key (PBKDF2, 250,000 iterations, random salt and IV per encryption) protects the message, producing a self-contained encrypted block you can copy and share safely. Nothing is ever sent to a server. Built by FreeToolHub.
Encrypt text
Type or paste the text you want to protect, choose a password, then encrypt it.
Encrypted with AES-256-GCM using a password-derived key (PBKDF2, 250,000 iterations, random salt and IV each time). Everything happens locally in your browser.
Decrypt text
Paste the encrypted block and the password used to create it to reveal the original text.
Password-protect any message with real AES-256-GCM encryption, entirely in your browser.
Frequently Asked Questions
How does this text encryption tool work?
It uses AES-256-GCM, an authenticated encryption algorithm, with a key derived from your password via PBKDF2 (250,000 iterations, SHA-256). A random salt and a random IV are generated for every encryption, then combined with the ciphertext into one self-contained block that is Base64-encoded for easy copying and sharing.
Is my text or password sent to a server?
No. Everything runs locally in your browser using the Web Crypto API. Your plain text, password, and encrypted output are never transmitted anywhere or stored.
What happens if I forget the password?
The encrypted text becomes permanently unreadable. There is no backdoor, master key, or recovery option — the encryption is only as strong, and as recoverable, as the password you remember.
Can someone else decrypt my message on a different device?
Yes. Anyone with the exact encrypted block and the correct password can decrypt it using this same tool in any browser — no account or installation required.
Why do I get "Incorrect password or corrupted data"?
This means either the password does not match the one used to encrypt, or the encrypted text was altered, truncated, or incompletely copied. Paste the full encrypted block exactly as it was generated.
Is this real encryption or just obfuscation?
It is real, industry-standard encryption. AES-256-GCM is the same authenticated-encryption algorithm used in TLS and modern secure-messaging apps, not a reversible cipher or simple text-scrambling trick.