Encrypt / Decrypt Text
Protect any text with a password using AES-256-GCM. Everything runs in your browser - your text and password never reach our servers.
-
How it works & security
- AES-256-GCM authenticated encryption - protects both confidentiality and integrity (tampering is detected on decrypt).
- Your key is derived from the password with PBKDF2-SHA-256, 250,000 iterations, using a fresh random salt. A random 96-bit IV is generated for every encryption.
- The output is Base64 containing
salt + IV + ciphertext. Keep your password safe - without it the text cannot be recovered. - All cryptography runs locally via the browser's audited Web Crypto API. Nothing is uploaded, logged, or stored.
How to Use Encrypt / Decrypt Text
Encrypt and decrypt text with a password using AES-256-GCM. 100% client-side - your text and password never leave your browser.
Type directly into the input field, paste from your clipboard, or upload a file. The tool accepts a wide range of inputs and handles edge cases automatically.
Click the action button or watch as the tool processes your input in real time. All computation happens locally in your browser - nothing is sent to any server.
Copy the output to your clipboard with one click, or download it as a file. Your data stays private throughout the entire process.
Why Choose PrivConvert?
Unlike other online tools that upload your files to remote servers, store them for days, and may use them for AI training or data mining, PrivConvert was built with privacy as the foundation.
Files are processed in volatile memory (RAM) and immediately purged. Nothing is ever written to disk or backed up.
All uploads and downloads are encrypted with TLS 1.3. Your files cannot be intercepted in transit.
Use any tool instantly without signing up, providing an email, or creating a profile. No tracking cookies, no user profiling.
Compatible with Windows, macOS, Linux, iOS, and Android. No plugins or desktop software needed - just a modern web browser.
Trusted by Thousands of Users
PrivConvert processes thousands of file conversions every day. Our commitment to privacy and security has made us the go-to choice for professionals, developers, and privacy-conscious users worldwide.
Frequently Asked Questions
Is Encrypt / Decrypt Text free to use?
Yes, completely free with no limits, no sign-up, and no hidden fees. Use it as many times as you want.
Is my data safe?
All processing happens directly in your browser. Your data is never sent to any server, never stored, and never shared. It's 100% client-side.
Does it work on mobile devices?
Yes. The tool works on any device with a modern web browser - smartphones, tablets, laptops, and desktops.
Do I need to create an account?
No. You can use the tool instantly without signing up, providing an email, or creating any profile.
The exact cryptography this uses
Vagueness about cryptography is a warning sign, so here are the parameters in full. Text is encrypted with AES-GCM at 256 bits. The key is derived from your password using PBKDF2-HMAC-SHA-256 with 250,000 iterations and a fresh 16-byte random salt, and every encryption gets a new random 96-bit IV.
Why each of those numbers
AES-GCM is authenticated encryption. As well as hiding the content it produces an authentication tag, so tampering with the ciphertext makes decryption fail loudly instead of returning wrong plaintext. Plain AES-CBC without a separate MAC does not give you that, and the difference has caused real vulnerabilities.
250,000 PBKDF2 iterations exist because people choose weak passwords. Deriving a key directly from a password would let an attacker test guesses as fast as their hardware allows; the iteration count makes each guess cost 250,000 hash operations instead of one. It is imperceptible when you type the right password once, and it multiplies the cost of a brute-force campaign by the same factor.
A fresh salt per encryption means two people using the same password get different keys, so an attacker cannot precompute one table and attack everyone. A fresh IV is a hard requirement of GCM - reusing an IV with the same key breaks the mode badly, so it is generated randomly every time rather than fixed or counted.
What it does not protect against
A weak password. The cryptography is sound, but 250,000 iterations only
multiplies the attacker's cost - it does not rescue summer2026. Use
a long passphrase, and note that there is no recovery: lose the password and the
text is gone, which is what "encrypted" has to mean.
All of it runs in your browser through the Web Crypto API. Neither the text nor the password is transmitted.