What does a password encryption utility do?
A password encryption utility turns readable text into ciphertext that can only be turned back with the same password. This one uses the browser's own Web Cryptography implementation: AES-GCM with a 256-bit key, and a key derived from your password with PBKDF2-SHA256 repeated hundreds of thousands of times. The encrypted result carries the salt, the initialisation vector and the iteration count it needs, so the same password recovers the text later.
Encryption here is real but the weak point is the password, not the cipher. AES-256 is not the part an attacker breaks; a short or predictable password is. Because the salt and the iteration count travel with the encrypted value, someone holding it can guess passwords offline at their own pace, and the stretching only makes each guess slower. That is why a long passphrase of unrelated words is far stronger than a short string of symbols, and why the password should never be stored beside the text it protects.
There is one boundary worth stating before you use it: the password is used in this page and nowhere else. Nothing is sent to a server and nothing is saved, which is exactly the point, but it also means there is no recovery. Lose the password and the text is gone, with no reset, no support route and no back door, because none of those can exist without a copy of the key.
How to encrypt text with a password
- Choose Encrypt text, and paste the text you want to protect.
- Type a password. A long passphrase of several unrelated words is far stronger than a short, clever-looking string.
- Repeat the password, since there is no recovery if it is mistyped.
- Choose the key stretching rounds — 300,000 is a sensible balance between safety and the wait on this device.
- Press Encrypt and copy the result. The whole value, including its header, is what decrypts it later.
- To read it again, choose Decrypt a value, paste it with the same password, and press Decrypt.
Password Encryption Utility limits and rules
| Item | Limit |
|---|---|
| Cipher | AES-256-GCM, authenticated, from the browser's Web Cryptography API |
| Key derivation | PBKDF2 with SHA-256, 100,000 to 600,000 rounds as chosen |
| Salt and IV | Fresh random values for every encryption, stored with the result |
| Output formats | A compact v1.<iterations>.<salt>.<iv>.<data> line, or multi-line JSON |
| Runs offline | Everything happens in the page; nothing is transmitted or saved |
| Passwords | Kept in memory while the page is open, never written anywhere |
| Not covered | Password recovery, key sharing, file encryption and any form of secure deletion |
When to use it
- Encrypting a note, a credential reminder or a private message before pasting it somewhere.
- Protecting text that will travel through a channel you do not fully trust.
- Checking that a password and a ciphertext go together by decrypting a round trip.
- Making a copy of a short secret that can only be opened with a passphrase.
- Demonstrating how salt and iteration count make the same password produce different ciphertext each time.
Is it private?
The encryption runs entirely in this page using the browser's cryptography, and the password never leaves memory. Nothing is uploaded, stored or logged, and closing the tab discards everything including the password.
Frequently asked questions
The cryptography is real — AES-256-GCM with a PBKDF2-derived key is a standard, sound construction, and it is the same primitive browsers use for TLS. The variable is your password. Because the salt, iteration count and ciphertext travel together, anyone who has the value can try passwords offline for as long as they like; the stretching makes each attempt expensive but cannot rescue a weak choice. For anything genuinely valuable, add a strong passphrase and consider a purpose-built tool or a password manager.
Because a fresh random salt and initialisation vector are generated for every encryption. The salt makes the derived key unique, so the same password never produces the same key twice, and the initialisation vector does the equivalent job for the message. That is deliberate: if encryption were deterministic, two identical plaintexts would produce identical ciphertexts, which leaks the fact that they match. The randomness is what makes the output unlinkable.
Decryption fails and reports that the password is wrong or the value has been altered. Those two cases are deliberately indistinguishable, because AES-GCM is authenticated: it checks that the ciphertext was not changed before returning anything, and a wrong key fails that check just as tampering does. Nothing partial is ever returned, which is why you will never see half-garbled text as a result of a near-miss password.
No, and no tool on any site could do so honestly. The password is the only source of the key, it is never stored, and nothing about the encrypted value records it. That is the property that makes the encryption meaningful — a recoverable ciphertext is one the operator can read too. Keep an unencrypted copy of anything you cannot afford to lose, or store the password in a password manager that is built for exactly that problem.
Five dot-separated parts: a version marker v1, the number of PBKDF2 rounds, the Base64 salt, the Base64 initialisation vector and the Base64 ciphertext. Everything needed to decrypt is there except the password, which is why the whole line must be copied — cutting the header off because it looks like noise would make the value undecryptable. The JSON format carries the same fields with names, which is easier to read and to store in a structured field.
No. It is for encrypting text you already have, and a password manager does a different job: it generates strong secrets, remembers them for you, fills them into sites, and stores the whole vault behind one strong passphrase. Using this tool to keep a list of credentials means keeping both the list and the passphrase safe yourself, which is more work than it sounds. Use it for notes and messages, and a password manager for passwords.
Related tools
Written and maintained by Md. Nur Hossain Repon.