Text Encrypt and Decrypt (AES-GCM)
Password-protect text with AES-256-GCM, and decrypt it again.
AES-256-GCM with a key from PBKDF2-SHA256 (600,000 iterations). Deriving the key takes a moment by design.
Use via API
Encrypt text with a password (AES-256-GCM, key from PBKDF2-HMAC-SHA256 with 600,000 iterations, random salt and IV) as one Base64 string, or decrypt such a string. Compatible with the PithLab Text Encryption tool. Send JSON, get JSON back.
POST https://pithlab.com/api/v1/tools/text-encryption
curl https://pithlab.com/api/v1/tools/text-encryption \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"input":"Meet at noon.","password":"correct horse battery staple","mode":"encrypt"}'About the Text Encrypt and Decrypt
Encrypt and decrypt text with a password using AES-256-GCM and PBKDF2 with 600,000 iterations. Output is one Base64 string. Runs entirely in your browser.
How to use the Text Encrypt and Decrypt
- Choose Encrypt, type or paste your text, and enter a strong password.
- Press Encrypt. Copy the Base64 result and send or store it wherever you like.
- To read it again, choose Decrypt, paste the Base64 text, enter the same password and press Decrypt.
- Share the password separately, for example by phone, never in the same message as the encrypted text.
Examples
Input
Password: correct horse, encrypted text: Aa+0jjZ/PkstRhyskGi6M400eR/5dan7JQX4LS7LMf52bQf1+Gayoqu0XE4SIFeROic0EKQ3UGPmGx3kGKBSAAyCb27Xpj6nlW06nw==
Output
Meet at the usual place at 6pm.
Input
Text: Meet at the usual place at 6pm., password: correct horse
Output
e.g. AXs3... (a different Base64 string every time, because the salt and IV are random)
Frequently asked questions
How does the encryption work?
Your password is turned into a 256-bit key with PBKDF2-HMAC-SHA256 using 600,000 iterations and a random 16-byte salt. The text is then encrypted with AES-256-GCM using a random 12-byte IV. GCM also adds a 16-byte authentication tag, so any change to the encrypted text is detected.
What is the output format?
One standard Base64 string of: a version byte (1), the 16-byte salt, the 12-byte IV, then the ciphertext followed by the 16-byte GCM tag. The version byte lets the format change later without breaking old messages. Any tool that follows this layout with the same settings can decrypt it.
Why is the result different every time?
A new random salt and IV are used for every message, so encrypting the same text with the same password twice gives different output. This stops anyone telling that two messages are the same.
What if I forget the password?
The text cannot be recovered. There is no back door and nothing is stored. Decrypting with the wrong password, or with text that has been changed or cut short, shows an error rather than garbage.
Is my text sent anywhere?
No. Encryption and decryption use the Web Crypto API built into your browser, and your text and password never leave your device. The security still depends on a strong password, so use a long passphrase.