Skip to content
XUtilHub

Encrypt & Decrypt Text with a Password (AES-256)

Encrypt messages and notes with a password using AES-256-GCM, and decrypt them again. Works in your browser; nothing is uploaded.

  • Free, no sign-up
  • Runs in your browser, nothing uploaded

About the Text Encryption

Protect a message or note with a password before sharing or storing it. Text is encrypted with AES-256 in your browser, and only someone with the password can read it.

Key features

  • AES-256-GCM authenticated encryption
  • Key derived from your password (PBKDF2, 600,000 iterations)
  • Random salt and IV every time
  • Detects wrong passwords and tampering
  • Works with any language and emoji
  • Runs entirely in your browser

Protect a message with a password

Encrypt a note, a set of Wi-Fi details or a message before you store or send it. Only someone with the password can decrypt it, using this page on any device.

How it works

  1. A random salt and your password produce a 256-bit key with PBKDF2 (600,000 rounds), which makes guessing passwords slow.
  2. The text is encrypted with AES-256-GCM using a random IV.
  3. Salt, IV and ciphertext are combined into one text that starts with xuh1..
  4. GCM includes an authentication tag, so a wrong password or any change to the text is detected.

Good uses

  • Sharing a password or PIN with someone you trust
  • Storing private notes in cloud documents or email drafts
  • Sending account details over chat

Passphrase generator for a strong password, Base64 encoder, and file hash checker.

How to use the Text Encryption

  1. Enter your text, password or settings in the tool above.
  2. Results appear instantly and are calculated in your browser.
  3. Read the explanation and warnings under the result.
  4. Copy what you need. Nothing is uploaded or stored.

Frequently asked questions

How secure is this?

It uses AES-256 in GCM mode, the same standard used by governments and banks, with a key derived from your password by PBKDF2-SHA-256 with 600,000 iterations (OWASP's current recommendation). The real weak point is the password: use a long, unique one.

Can you recover my text if I forget the password?

No. There's no backdoor and nothing is stored on our servers. Without the password, the text can't be decrypted by anyone.

How should I share the password?

Through a different channel from the encrypted text. For example, email the encrypted text and tell the password by phone or in person.

Why does the same text encrypt differently each time?

A new random salt and IV are used every time, so identical messages give completely different outputs. That's intentional and prevents attackers from spotting repeats.

Are my passwords and files sent to your servers?

No. All checks, hashing and encryption run in your browser using its built-in Web Crypto features. The only network request is the optional breach check, which sends just the first 5 characters of your password's SHA-1 hash, never the password.

Can I trust browser-based security tools?

These tools use the same standard algorithms (AES-GCM, PBKDF2, SHA-2, HMAC) built into your browser. Still, never type the passwords or 2FA secrets of important accounts into any website you don't control.

Do the tools work offline?

Yes. Once a page has loaded, everything except the breach check works without a connection.

Last updated:

Related Security tools

Data Redaction ToolNEW

Mask emails, phone numbers, card numbers, CNIC, Aadhaar, IBANs and IP addresses in text before sharing logs, screenshots or documents.

Secret Key GeneratorNEW

Generate cryptographically secure random keys for APIs, JWT secrets, session secrets and encryption, in hex, Base64 or Base64URL.

Password Strength CheckerNEW

Check how strong your password is, how long it would take to crack, and whether it appeared in a data breach, without your password leaving your device.

Passphrase GeneratorNEW

Generate strong, easy-to-remember passphrases from random words using the EFF diceware word list, with entropy shown.

2FA Code Generator (TOTP)NEW

Generate time-based one-time passwords (TOTP) from a Base32 secret, create new 2FA secrets and otpauth QR codes for authenticator apps.

File Hash CheckerNEW

Calculate MD5, SHA-1, SHA-256 and SHA-512 checksums of any file and compare with the expected hash to verify downloads. Files stay on your device.