Encrypt and decrypt files of any type using AES-256-GCM with password-based key derivation, processed entirely client-side.
A selected file becomes authenticated AES-256-GCM ciphertext under a 256-bit key derived from the password you enter. Supplying compatible ciphertext and the same password reverses the operation. The tool treats the file as binary data, so it can handle documents, images, archives, audio, and other formats without interpreting their contents. Processing remains entirely inside the browser. The common surprise is that the password is not attached to the encrypted file in recoverable form. Losing it can make the contents inaccessible, while changing even part of the ciphertext causes authentication to fail.
When you select a file and enter a password, the tool converts that password into a 256-bit AES key through password-based key derivation. AES-GCM then encrypts the file bytes and produces an authentication tag associated with the ciphertext and encryption parameters. The result is opaque encrypted data rather than an ordinarily readable copy with a password prompt.
For decryption, provide an encrypted file in the format expected by this tool and enter the exact password used originally. The tool derives the key again and asks AES-GCM to authenticate the encrypted data before recovering the plaintext bytes. A wrong password, damaged ciphertext, altered authentication data, or incompatible file format should produce a decryption failure instead of plausible but corrupted output.
No built-in property of AES-GCM can recover a forgotten password. Decryption requires recreating the same key, which in this workflow depends on the original password and derivation parameters. Unless the password can be recovered from your own records or feasibly guessed, the ciphertext is intended to remain inaccessible. Keep a verified password record before discarding the original file.
No. Compatibility requires more than selecting AES-256-GCM. Both applications must agree on how the password becomes a key, which derivation parameters are used, how the GCM nonce and authentication tag are stored, and how the encrypted file is packaged. Use the same tool for decryption unless another application explicitly supports its format, and test recovery before relying on the encrypted copy.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.