Text Encryption Tool

Protect a message, note or secret with a password: the text is encrypted with AES-256-GCM using a key derived by PBKDF2-SHA256, and you get a Base64 string that only someone with the password can decrypt. Everything happens on your device.

How to use the Text Encryption Tool

1. Choose Encrypt, then type or paste the text you want to protect.
2. Enter a strong password or press Generate to create one. Share it with the recipient through a different channel.
3. Press Encrypt text and copy the Base64 result.
4. To read it, choose Decrypt, paste the encrypted text, enter the same password and press Decrypt text.
5. If decryption fails, check the password; any change to the encrypted text is also detected.

How the encryption works

1. Key derivation: a random 16-byte salt is generated, and a 256-bit key is derived from your password with PBKDF2-HMAC-SHA256 (600,000 iterations by default, as recommended by OWASP in 2023). The salt makes every key unique, and the iterations make each password guess slow.
2. Encryption: the UTF-8 text is encrypted with AES-256 in Galois/Counter Mode (GCM) using a random 12-byte IV. GCM appends a 16-byte authentication tag that detects any change to the data or a wrong key.
3. Packaging: everything needed to decrypt, except the password, is stored in one Base64 string.

Output format

The whole byte sequence is Base64-encoded (standard or URL-safe). Encrypted text is therefore about 4/3 of the original size plus 66 characters of overhead.

Decrypt the output in Python

import base64
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

def decrypt(b64_text, password):
    s = b64_text.strip().replace('-', '+').replace('_', '/')
    data = base64.b64decode(s + '=' * (-len(s) % 4))
    assert data[0] == 1
    iterations = int.from_bytes(data[1:5], 'big')
    salt, iv, ct = data[5:21], data[21:33], data[33:]
    key = PBKDF2HMAC(hashes.SHA256(), 32, salt, iterations).derive(password.encode())
    return AESGCM(key).decrypt(iv, ct, None).decode()

Choosing a good password

• Use at least 12 random characters or a passphrase of four or more random words. The strength hint estimates the entropy; aim for Strong (65+ bits).
• Never reuse a password from another account, and send it to the recipient through a different channel than the encrypted text.
• More PBKDF2 iterations slow down attackers, but they cannot save a weak password: each extra character adds far more protection than doubling the iterations.

Frequently asked questions

Related tools