Encrypt text with a password

Turn a private message into a line of scrambled text that only someone with the password can read, and decrypt it again right here. AES-256-GCM, done in your browser. Nothing is uploaded or saved.

  • Never uploaded or saved
  • AES-256-GCM
  • No account

The text to keep private. Any language and emoji, up to 1 MB.

The person decrypting needs exactly this password. Send it separately from the encrypted text.

Runs in your browser. Your text and password are never uploaded or saved, and the fields empty when you leave the page.

Encrypted text

How it works

How to password-protect a message

  1. Write and lock

    Type or paste your message, choose a strong password and press Encrypt. You get one line of text starting with trezio1.

  2. Send it two ways

    Send the encrypted text by email or chat. Tell the password another way, in person, by phone or in a different app.

  3. Decrypt here

    The other person opens this page, switches to Decrypt, pastes the text and types the password. The message comes back exactly.

The format

What is inside the encrypted text

One line: trezio1. followed by base64url of the parts below, in this order. Everything except the password is in the text, so any standard PBKDF2 and AES-GCM library can decrypt it with the right password (the 33-byte header is the GCM additional data).

Version

One byte, currently 1, so the format can change later without breaking old messages.

trezio1. + 0x01

Iterations

How many PBKDF2-SHA-256 rounds turned the password into the key: 600,000, the same as Trezio's vault. Stored as 4 bytes.

0x000927C0 = 600,000

Salt

16 random bytes, new every time. The same password gives a different key for every message, so precomputed guesses don't help.

16 bytes, random

IV

12 random bytes, new every time, so the same message encrypted twice never looks the same.

12 bytes, random

Ciphertext

Your message as UTF-8, encrypted with AES-256-GCM. It is exactly as long as the message.

1 byte per byte of text

Tag

16 bytes that prove nothing was changed. The header above is covered too, so any edit, or a wrong password, makes decryption fail.

16 bytes, GCM tag

FAQ

Questions about encrypting text

Is this text encryption secure?

The encryption is standard and strong: AES-256-GCM from your browser's built-in Web Crypto, with a key made from your password by PBKDF2-SHA-256 and 600,000 iterations. How safe your message is depends on the password. Anyone who gets the encrypted text can try passwords on their own computer, so a short or common password can be guessed. Use a passphrase of four or more random words.

What do AES-256-GCM and PBKDF2 do?

PBKDF2 turns your password into a 256-bit key. It repeats HMAC-SHA-256 600,000 times with a random salt, which makes every password guess slow for an attacker. AES-256-GCM then encrypts the message with that key and adds a tag that detects any change, so damaged or edited text is refused instead of decrypting to garbage.

How do I decrypt a message?

Open this page, switch to Decrypt, paste the whole encrypted text starting with trezio1. and type the password it was encrypted with. If the password is wrong or the text was cut off or changed, you see one error that does not say which, so it gives an attacker no hints.

How should I share the password?

Through a different channel from the encrypted text. If you email the text, give the password in person, by phone or in another app. Anyone who has both can read the message, so never send them together.

Is my text uploaded or saved?

No. Encryption and decryption happen in your browser with its built-in Web Crypto, and the page has no code that sends your text or password anywhere. Nothing is saved either: not in local storage, not in the page address. The fields are emptied when you leave the page.

What if I forget the password?

Then the message cannot be recovered, by you, by us or by anyone else. Trezio never sees the password or the text, and there is no backdoor. Keep the original message somewhere safe if you will need it again.

Can this replace an encrypted messaging app?

No. Apps with end-to-end encryption, such as Signal, exchange keys for you and protect every message automatically. This tool is for the odd case: a private note in an email, a secret kept in a shared document, or text you want to store locked. It does not hide who you sent it to or when.

How is this different from Trezio?

This tool encrypts one message and forgets it. Trezio's vault uses the same design, AES-256-GCM and a 600,000-round PBKDF2 key from a master password that never leaves your device, to keep your logins encrypted in the same library as the links and notes you save. There's a free plan.

More free tools

Make the password strong