Text Encryption & Decryption Tool
Lock any message with a password using real AES-256 encryption, then unlock it again. Everything runs in your browser, so nothing is uploaded or stored.
Camera access needs your permission, and works best on https:// pages.
Leave empty and we'll auto-generate a suitable image. PNG output only — JPEG, WhatsApp, and other apps that recompress images will destroy the hidden data, so share the downloaded PNG file directly.
Keep creating
About this generator
This tool encrypts text with AES-256-GCM, a modern standard used by banks and messaging apps, and turns your password into a key with PBKDF2 and a random salt. Encryption and decryption both run inside your own browser, so your text and your password never leave your device and nothing is saved on our servers. You can add an expiry, protect a message with two passwords, share it as a link or a QR code, or even hide it inside an image. Only people who know the password can read it.
How to use this tool
- 1
Type your message and a password
Write or paste the text, then choose a strong password. The strength meter shows how hard it would be to guess.
- 2
Encrypt and share
Tap Encrypt, then copy the result, send it as a link or QR code, or hide it inside an image.
- 3
Decrypt with the password
Switch to Decrypt, paste the encrypted text and enter the same password to read the message.
Frequently asked questions
- Is my text ever sent to a server?
- No. Encryption and decryption both happen inside your own browser using JavaScript. Nothing you type is uploaded or stored anywhere.
- What happens if I forget my password?
- There's no way to recover it. Since nothing is stored, no one — including this website — can decrypt your text without the exact password. A hint you set yourself may help jog your memory.
- What does "self-destruct" actually do?
- It stores an expiry rule inside the encrypted text itself. Once that time passes (checked using the device's own clock), this tool will refuse to decrypt it, even with the correct password.
- Is "one-time use" enforced everywhere?
- It's enforced per device/browser using local storage, not by a server. The same encrypted text could still be opened once on each different device or browser it's opened in.
- Will my line breaks and formatting be preserved?
- Yes. Encryption works on the exact text you enter, so line breaks and spacing come back exactly as you wrote them after decrypting.
- Why does decryption sometimes fail?
- This happens if a password is even slightly wrong, if the text was altered, or if the message has expired. Double-check both and try again.
- What changed with the password-based key derivation?
- Your password is no longer turned directly into an encryption key. It now goes through PBKDF2-SHA256 with 60,000 iterations and a unique random salt per message, which makes offline password-guessing attacks dramatically slower and more expensive. This is now done with your browser's built-in native encryption engine (Web Crypto) instead of a pure-JavaScript library, so it's much faster and the page never freezes while it runs — and the cipher itself (AES-256-GCM) is authenticated, so a wrong password is detected immediately instead of occasionally producing garbled text.
- How does hiding a message in an image work?
- The encrypted text is written into the least-significant bit of each pixel's color channels — changes too small for the eye to notice. Only someone using this tool's "Load from image" option can pull the hidden data back out, and they'd still need the correct password afterwards.
- Can I scan a QR code instead of pasting text?
- Yes — in Decrypt mode, use the QR icon to either scan one live with your camera or upload a photo/screenshot of it. The decoded text is read straight into the box; this still happens entirely on your device.