Encrypt and Decrypt Text
Encrypt any text with a passphrase using AES-256-GCM, right in your browser. Decrypt it back with the same passphrase. Nothing is uploaded.
Real encryption, done on your device
This tool uses AES-256-GCM, the same authenticated cipher trusted across the modern web. Your passphrase is stretched into a key with PBKDF2 (SHA-256, 150,000 iterations) over a fresh random salt, and each message gets a random 12-byte IV. The salt, the IV, and the ciphertext are packed into a single Base64 string, so you only have to keep that one block of text and the passphrase. To read it again, switch to Decrypt, paste the Base64, and enter the same passphrase. Get the passphrase wrong and you will see a friendly error, because GCM refuses to return anything it cannot verify.
Encryption you do not have to think about
Encrypting one message by hand is great for a quick secret, but it does not scale to the hundred things you copy every day. Relic is the end-to-end encrypted memory for everything you copy, masked by default, searchable across all your devices, and readable only by you, including by us. The math here is the same idea Relic runs on. Encrypt a note for free, and when you want it to just happen automatically, that is what Relic is for.
Frequently asked questions
How do I encrypt text with a password?
Type your text, enter a passphrase, and press Encrypt to get a single Base64 block back. To read it later, switch to Decrypt, paste that block, and enter the same passphrase. It all happens in your browser, and your passphrase never leaves the page.
What encryption does this tool actually use?
It uses AES-256-GCM, an authenticated cipher, with your passphrase stretched into a key by PBKDF2 (SHA-256, 150,000 iterations) over a fresh random 16-byte salt, and a random 12-byte IV per message. The salt, IV, and ciphertext are packed into one Base64 string, so that single block plus your passphrase is all you need to decrypt.
What happens if I lose the passphrase?
There is no recovery. The key is derived from your passphrase alone, so if you forget it the text cannot be decrypted by you or by anyone else, including us. Because GCM verifies integrity, a wrong passphrase or any tampering with the encrypted block just returns an error rather than wrong text.
How strong is this in practice?
The cipher is genuinely strong, but the real security comes down to your passphrase. A short or common passphrase can be guessed no matter how good the algorithm is, so use something long and unique. The 150,000 PBKDF2 iterations slow down guessing, but they cannot rescue a weak passphrase.
Is my passphrase or text sent to a server?
No. The encryption and decryption run entirely in your browser using the Web Crypto API, and the passphrase never leaves the page. Relic, the product this tool comes from, is built on the same idea of encrypting on your device, though its app uses a different cipher rather than the AES-256-GCM here.