Text Encrypt / Decrypt

Encrypt text as AES-256-GCM JSON, detect changed messages on decrypt and recover older CryptoJS text.

Operation

Text and passphrases are processed in this browser, not uploaded or added to the URL. There is no password recovery. Keep a separate safe backup.

Plain text

Passphrase

Confirm passphrase

Show passphrase

Use 12+ characters, preferably a unique random passphrase. Spaces and letter case matter. Share it separately from the encrypted message.

New format: AES-256-GCM, 128-bit authentication tag, fresh 16-byte salt and 12-byte IV, PBKDF2-SHA-256 with 600,000 iterations. This is not a password manager or an independently audited secure-messaging system. Browser extensions and a compromised device can still access what you type.

This tool runs entirely in your browser. Your data is never uploaded, never stored, and never leaves your device.

Encrypt local text into a versioned AES-256-GCM message, decrypt it with the exact passphrase, or recover older CryptoJS messages in a separate legacy mode.

How to use it

1Choose Encrypt and enter text up to 256 KiB.
2Enter and confirm a long unique passphrase of at least 12 characters.
3Encrypt and save the complete JSON; keep the passphrase separately.
4Choose Decrypt, open or paste the JSON, and enter the same passphrase.

Example

Input: A Unicode note and a matching passphrase
Output: Encrypted JSON that decrypts to the original note

New random salt and IV on every encryption; no recovery if the passphrase is lost.

What happens to your data

Messages and passphrases are processed locally, not uploaded or saved in browser storage. Explicit clipboard/download actions create copies you must protect. This is not an independently audited secure-messaging system.

Last updated October 2026

Encrypt a text message with a passphrase, save the encrypted JSON, and decrypt it later in the same format. New messages use authenticated AES-256-GCM through your browser’s Web Crypto API. A wrong passphrase or a changed encrypted payload fails without displaying a partial plaintext result.

This tool is useful for protecting a small text note before storing or sharing it. It is not a password manager, a secure-messaging service or a guarantee against a compromised device. The recipient needs both the complete encrypted message and the exact passphrase; send them through separate channels. Keep a safe backup because there is no recovery service.

How it works

Enter between 1 byte and 256 KiB of UTF-8 text. New encryption requires a passphrase of at least 12 characters and a matching confirmation, with a maximum of 1,024 UTF-8 bytes. A long, unique random passphrase is preferable to a predictable sentence. Spaces, letter case and Unicode composition are preserved; visually similar passphrases can therefore produce different keys. Incomplete Unicode characters are rejected rather than silently replaced.

Each new encryption generates a random 16-byte salt and a separate random 12-byte IV. PBKDF2-HMAC-SHA-256 with 600,000 iterations derives a non-exportable 256-bit AES key. AES-GCM adds a 128-bit authentication tag. The downloaded Toolvore v1 JSON contains the format, version, algorithm identifiers, iteration count, salt, IV and ciphertext with its tag. Binary fields use standard Base64. The authenticated additional data is the UTF-8 string Toolvore text v1|AES-256-GCM|PBKDF2-SHA256|600000. This describes the transport format; the encryption algorithm itself is the browser implementation, not a custom cipher.

Decrypt expects the complete v1 JSON, pasted or opened as a local encrypted file. Parameters and sizes are checked before expensive key derivation; arbitrary iteration counts are not accepted. Changing any message, passphrase or mode clears the previous result. Clear all also invalidates an in-flight result, although a Web Crypto operation already running may finish internally. Copy and download are explicit actions; decrypted TXT files and copied plaintext are no longer encrypted.

Legacy decrypt is a separate recovery-only mode for earlier CryptoJS AES, TripleDES, Rabbit and RC4 messages. It never creates new legacy ciphertext. These older formats lack authentication: readable output alone cannot establish that a message or passphrase was correct. Verify recovered text independently before encrypting it in the new format. Toolvore v1 is not directly interchangeable with OpenSSL salted strings or another website’s AES settings.

The tool does not upload the text, passphrase or resulting message and does not put them in URLs or browser storage. Page assets and anonymous usage events may still make network requests. Browser extensions, clipboard history, downloads, screenshots and a compromised page or device remain outside this protection. Clearing the form is not a promise of forensic memory erasure. Use an independently audited application for high-risk secrets or regulated information.

Worked example: encrypt and recover a Unicode note

Input: A short note containing नमस्ते 🌏 and a long unique passphrase
Result: Toolvore v1 JSON; decrypting with the same passphrase restores the original note

Ciphertext differs on each encryption because the salt and IV are freshly randomized. A wrong passphrase fails.

Common use cases

Protecting a small note before keeping an encrypted local copy
Sharing an encrypted message with the passphrase supplied separately
Recovering an older Toolvore CryptoJS message before migrating it
Learning the distinction between Base64 encoding and authenticated encryption

Frequently asked questions

How do I encrypt text with a password?＋

Choose Encrypt, enter the text and a long unique passphrase, confirm the passphrase and choose Encrypt text. Download or copy the complete encrypted JSON. Keep the passphrase separately; it is not included in the file.

Is AES encryption the same as Base64 encoding?＋

No. Base64 is a reversible representation of bytes, with no secret. Here Base64 stores the encrypted bytes, salt and IV inside JSON. Recovering the original text requires the passphrase and successful AES-GCM authentication.

Why is the encrypted text different each time?＋

Every encryption generates a fresh random salt and IV. The same note and passphrase therefore produce different JSON ciphertexts. Save the entire message, not just its data field.

Can you recover a forgotten passphrase?＋

No. The site has neither a recovery key nor a copy of your message. Losing the passphrase can mean losing access to the text. Test a saved message with its passphrase before relying on it.

What does a decryption failure mean?＋

The passphrase may be wrong, the JSON may be damaged or altered, or the format may be unsupported. The tool does not distinguish wrong keys from authentication failure and does not reveal unauthenticated partial text.

Can I decrypt an old U2FsdGVk message?＋

Choose Legacy decrypt and the original CryptoJS algorithm. This mode is for recovery, not new encryption. Its output has no authentication guarantee; independently verify the recovered text before using it.

Does this make any message completely secure?＋

No. Passphrase strength, device security, browser extensions and how you share the passphrase all matter. This browser tool is not independently security-audited and should not replace an audited system for high-risk secrets.