Encrypt and decrypt text messages using multiple cipher algorithms including AES, ChaCha20, and Triple DES.
Symmetric encryption uses one secret for both directions: the same passphrase that scrambles your text is the one that unscrambles it. You pick a cipher - AES, ChaCha20, or the legacy Triple DES - type your message and a passphrase, and the tool returns a ciphertext string you can copy anywhere. Pasting that string back in with the same secret reverses the process. Everything runs in the browser, so your plaintext never leaves the machine. The part people most often get wrong: there is no recovery. Forget or mistype the passphrase and the message is permanently lost, by design.
AES is a block cipher with 128, 192 or 256-bit keys - the current standard (NIST FIPS 197). ChaCha20 (RFC 8439) is a stream cipher with a 256-bit key that XORs a keystream into the message; it is fast in software and usually paired with the Poly1305 authenticator. Triple DES, the oldest, was withdrawn as a NIST standard in 2023. All three are symmetric: the same key must reverse the process.
A passphrase is not key material: the tool must turn it into key bytes, stretching it with a key-derivation function such as PBKDF2 or scrypt and adding a salt, so the same message and passphrase never produce the same ciphertext twice. The salt and IV are bundled with the ciphertext, so every character of the output string matters: truncating it breaks decryption, and re-encrypting identical text gives a different string each run.
No. The design has no backdoor: the ciphertext contains no information from which the passphrase can be derived, so a forgotten or mistyped passphrase is unrecoverable. The practical safeguards are unglamorous: use a strong passphrase, keep it in a password manager, and test-decrypt a fresh encryption before relying on the scheme.
Yes, in the narrow sense: without the passphrase the ciphertext is unreadable, so public posting does not leak the message - provided the passphrase is genuinely strong and never travels through the same channel. Remember the output still reveals message length, and posting time and string length remain visible to anyone.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.