Encrypt Text or Files Online
Encrypt text or files with AES-256-GCM in your browser. Nothing is uploaded, no account is needed, and the key stays on your device.
AES-256-GCM encrypts and decrypts here with a key derived from your passphrase by PBKDF2. The same passphrase always reproduces the same key, and no key or plaintext is ever sent anywhere.
Tool workspace
Select operation mode
Your password stays in your browser.
Ctrl+Enter to execute · Esc to clear
No result yet
Enter your input above and the result will appear here.
Read the details +
What is AES-256-GCM?
AES-256-GCM (Advanced Encryption Standard with 256-bit key in Galois/Counter Mode) is an authenticated encryption algorithm that provides both confidentiality and integrity protection. It is specified in NIST FIPS 197 and NIST SP 800-38D; RFC 8446 (TLS 1.3) lists AES-256-GCM cipher suites among those implementations should support.
How It Works
- Key Derivation (PBKDF2): Your password is transformed into a 256-bit encryption key using PBKDF2 (Password-Based Key Derivation Function 2) with 100,000 iterations of HMAC-SHA256. This makes brute-force attacks computationally expensive.
- Random Salt: A unique 16-byte salt is generated for each encryption operation, ensuring that encrypting the same data twice produces different ciphertexts.
- Initialization Vector (IV): A 12-byte nonce (IV) is used to ensure that identical plaintext blocks encrypt to different ciphertext blocks.
- Authenticated Encryption: GCM mode encrypts the data while simultaneously computing an authentication tag (128-bit) that detects any tampering with the ciphertext.
Technical Specifications
Encryption
- • Algorithm: AES-256-GCM
- • Key Size: 256 bits
- • IV Size: 96 bits (12 bytes)
- • Auth Tag: 128 bits
Key Derivation
- • KDF: PBKDF2-HMAC-SHA256
- • Iterations: 100,000
- • Salt Size: 128 bits
- • Output: 256-bit key
References & Standards
Encryption Export Compliance
This tool uses the browser's Web Crypto API (SubtleCrypto) — standard browser functionality. No proprietary cryptographic code is downloaded or executed. All encryption operations happen locally on your device.
Read our encryption export compliance guide →How to Encrypt Text or Files Online Securely
Learn how to encrypt and decrypt sensitive data in your browser using AES-256-GCM encryption.
- 1
Choose Encryption Mode
Select between "Text" for messages or "File" for documents.
- 2
Enter Data & Password
Input your text or upload a file, then set a strong password.
- 3
Encrypt or Decrypt
Click the action button. All processing happens locally in your browser.
- 4
Use Your Result
Copy the encrypted text or download the secured file for safekeeping.
When to Use This Tool
- 1Encrypt sensitive configuration files before sharing via email or cloud storage
- 2Protect personal documents stored on USB drives or external storage
- 3Secure password backups or recovery codes
- 4Encrypt notes or diary entries for personal privacy
Security Tips
- Use a strong, unique password that you have never used elsewhere
- Store your password securely—if lost, encrypted data cannot be recovered
- For highly sensitive data, consider using multiple layers of encryption
- Always verify the encrypted file can be decrypted before deleting the original
Frequently Asked Questions
Is my data uploaded to a server?
No. Encryption and decryption run entirely in your browser using the Web Crypto API. Your text or files never leave your device.
How is the encryption key derived?
Your password is stretched with PBKDF2 at 100,000 HMAC-SHA256 iterations and a fresh random 16-byte salt to derive an AES-256-GCM key locally. Neither the password nor the derived key is ever transmitted.
Can I encrypt files, not just text?
Yes. You can encrypt and decrypt files up to 50MB and download the encrypted output or decrypted original.
What happens if I forget my password?
The data cannot be recovered. The key is derived from your password in the browser, and neither the password nor the key is stored or transmitted, so there is no reset link and no recovery key. Keep the password in a manager, or export the key file as a backup of both the key and the parameters.
Which encryption algorithm and parameters protect the data?
AES-256-GCM with a key derived from your passphrase using PBKDF2-HMAC-SHA256 (100,000 iterations) and a fresh 16-byte salt. Each message gets a random 12-byte IV, and the GCM authentication tag makes tampering detectable at decryption time. The salt and IV are stored next to the ciphertext; the password and key are not.
Related Guides
Related Security Tools
Encryption background on zeyrovault.com
You are responsible for key management and output validation.