AES Text & File Encryption

How to use

1. Choose Encrypt, and Text or File. Type or paste the text, or drop the file (up to 200 MB).
2. Enter a passphrase and type it again to confirm. Several random words or 16 or more characters are a good target. The hint under the field only counts characters; it cannot tell whether a phrase is common.
3. Leave the iterations at 600,000 unless you want each guess to cost an attacker more; higher counts also make your own encrypting and decrypting slower.
4. Click Encrypt. For text, copy the result, which starts with itb1. For a file, click Download to save name.enc. The original file name is stored inside the encryption, not in the clear.
5. To decrypt, choose Decrypt, paste the text or drop the .enc file, enter the passphrase and click Decrypt. Text appears in the box; a file is offered for download under its original name.
6. If the passphrase is wrong or a single byte of the data has changed, you get "Could not decrypt" and no output at all, never partial or garbled plaintext.

Examples

itb1.600000.AAECAwQFBgcICQoLDA0ODw.oKGio6Slpqeoqaqr.qm6zzR5QschWXjLGbPAt3Zcsm13Ze-jBPvJEnR4PD3lT_ratnTxmpF0BUhcINso

itb1      600000      AAECAw…Dw      oKGio6…qr     qm6zzR…so
version   iterations  salt (16 B)    IV (12 B)     ciphertext + 16-byte tag

openssl enc -d -aes-256-cbc -pbkdf2 -iter 600000 -md sha256 -a -in message.enc.txt

Supported formats

• Cipher: AES-256-GCM with a 96-bit random nonce (IV) and a 128-bit authentication tag. Key: PBKDF2-HMAC-SHA-256 over the UTF-8 passphrase (normalised to Unicode NFC), a 16-byte random salt and 600,000 iterations by default (1,000,000, 2,000,000 or 5,000,000 selectable). A new salt and IV are generated for every encryption.
• File container (.enc), all integers big-endian: bytes 0–6 ASCII "ITBAES1"; byte 7 format version (1); bytes 8–11 iteration count (uint32); bytes 12–27 salt; bytes 28–39 IV; byte 40 onwards the AES-GCM ciphertext followed by the 16-byte tag. The 40-byte header is the GCM additional authenticated data, so changing it also makes decryption fail.
• Text token: itb1.<iterations>.<salt>.<iv>.<ciphertext+tag>, the same fields as the file header with the binary parts in Base64url without padding. A token and a container can be converted into each other exactly. Line breaks and spaces added while copying are ignored.
• Encrypted plaintext layout: 1 byte kind (1 = text, 2 = file), 2-byte name length, the UTF-8 file name (empty for text), then the data. Size overhead is 59 bytes plus the file name (about 4/3 of that for text tokens, plus the Base64 growth of the data).
• OpenSSL interop (under Interop / advanced): reads and writes the format of openssl enc -aes-256-cbc -pbkdf2 -iter N -md sha256: "Salted__", an 8-byte salt, then AES-256-CBC with PKCS#7 padding; key and IV are the first 48 bytes of PBKDF2-HMAC-SHA-256. Text is Base64 in 64-character lines, as openssl -a writes it. It is detected automatically when decrypting (Salted__ or U2FsdGVkX1).

Privacy

This tool runs entirely in your browser. Nothing you enter or open is sent anywhere. Privacy policy.

Limitations

• Security rests entirely on the passphrase. PBKDF2 slows guessing down but does not stop it: a short or common passphrase can be found by an attacker who has the encrypted data. There is no recovery or reset. If you forget the passphrase, the data is gone.
• Encryption does not hide size. The output is the input size plus about 60 bytes, so anyone who sees it can tell roughly how big the original was.
• This page's format is its own. Other tools, including openssl enc, cannot read it without code that follows the layout above. Use the OpenSSL option when the other side uses openssl.
• Files are processed whole in memory, so the limit is 200 MB per file, and large files need several times that in free memory. Very old phones may run out sooner. For bigger files use a desktop tool such as age, 7-Zip (AES-256) or openssl.
• The OpenSSL format has no integrity check. A wrong passphrase or iteration count is usually caught by the padding check, but about 1 time in 256 it produces garbage instead of an error, and modified data can go unnoticed. Data made without -pbkdf2 (the old EVP_BytesToKey default), with -md md5 or with -nosalt is not supported.
• Anything already on your device, such as malware, a screen recorder or a browser extension with page access, can see the passphrase and plaintext as you type them. The tool protects data at rest and in transit, not on a compromised device.

FAQ

Is my data or passphrase uploaded?

No. Encryption and decryption use the Web Crypto API built into your browser (crypto.subtle), and the random salt and IV come from crypto.getRandomValues(). The page makes no network request with your data and loads no third-party library for this tool.

Why does decrypting not ask for the iteration count, salt or IV?

They are stored in the encrypted text or file header. None of them is secret: the salt makes each key unique, the IV makes each encryption unique, and the iteration count tells the decryptor how much work to repeat. Only the passphrase is secret.

Why 600,000 iterations?

It is the figure OWASP's Password Storage Cheat Sheet gives (from 2023) for PBKDF2-HMAC-SHA-256. Every guess an attacker makes has to repeat those iterations, so higher is slower to attack. How long it takes depends on your device — typically around a second, longer on older phones. You can choose up to 5,000,000 if the extra wait is acceptable.

What happens if I type the wrong passphrase?

AES-GCM checks an authentication tag before releasing anything, so a wrong passphrase, a damaged download or a deliberately altered byte all give the same message: could not decrypt — wrong passphrase or the data was modified. You never get partial or scrambled output in this page's format.

Can I decrypt this with openssl on the command line?

Not the default format: openssl enc does not support AES-GCM, and its own format is AES-CBC with a Salted__ header. If you need to exchange data with openssl, open Interop / advanced and tick Encrypt in OpenSSL format; the page shows the matching openssl command. Decrypting openssl -pbkdf2 output works the same way, as long as you enter the -iter value it was made with (10000 if it was left out).

Does the encrypted file reveal the original file name?

No. The name is stored inside the encrypted part and only comes back after a successful decryption. The download is called name.enc only because that is the name you see when saving it; rename it to anything you like before sending.

Is AES-256 actually stronger than AES-128 here?

Both are far beyond brute force. In practice the passphrase is the weak point: a 12-character random passphrase has far less entropy than a 256-bit key. That is why the iteration count and passphrase length matter more than the key size.

Related tools

All security tools →