UtilibyWritten by the Utiliby editorial team · Last updated October 14, 2026 · Rules and formulas reviewed October 2026
What this free file encryption tool does
Photos, scans, contracts, tax records and backups often end up in cloud storage, email attachments or on a USB stick. If the storage is hacked, lost or shared by mistake, an unprotected file is open to anyone. Encrypting the file first means that whoever gets it sees only scrambled data, and only the password turns it back into the original.
This free online file encryption tool does that in your browser. Drop in one or more files, enter a password and download the encrypted copies. It uses AES-256-GCM, the same kind of encryption used by banks and disk encryption, with a key derived from your password. The files are never uploaded, so nobody else can read them or reset the password.
How to encrypt and decrypt files
- Encrypt. Open the Encrypt tab, drop your files, enter a strong password twice and press Encrypt files.
- Download. Each file gets a Download button. The encrypted copy ends in .utf1.
- Store and share. Keep the encrypted file anywhere. Send the password through a different channel.
- Decrypt. Open the Decrypt tab, choose the .utf1 file, enter the password and press Decrypt files. You get the original file back with its name.
Keep the original until you have tested the decryption once.
How the encryption works
Your password is stretched into a 256-bit key with PBKDF2 (HMAC-SHA-256) and a random salt, using the number of rounds you choose. The file is cut into 1 MiB pieces, and each piece is sealed with AES-GCM and a unique nonce. Every piece also authenticates its position in the file and whether it is the last piece. That means a changed piece, a swapped piece or a missing final piece makes decryption fail instead of returning wrong data.
The original name, size, type and modified time are stored as an encrypted first block, so they are hidden. A wrong password fails right at that first block, which makes the check fast even for large files.
File format for developers
| Bytes | Content |
|---|---|
| 0 to 2 | Letters UTF (0x55 0x54 0x46) |
| 3 | Version, 1 |
| 4 | Rounds code: 0 = 100,000, 1 = 310,000, 2 = 600,000, 3 = 1,000,000 |
| 5 to 20 | Salt, 16 bytes |
| 21 to 28 | Nonce prefix, 8 bytes |
| 29 to 32 | Chunk size, 4 bytes, big endian (1,048,576) |
| 33 to 36 | Length of the encrypted metadata block |
| Then | Metadata block, then data chunks, each with a 16-byte tag |
The nonce of block number i is the 8-byte prefix followed by i as 4 bytes, big endian. The additional authenticated data is the 33 header bytes, then i as 4 bytes, then one byte that is 1 for the last block and 0 otherwise. The metadata block is number 0 and holds a JSON object. Data blocks start at number 1.
Choosing a good password
An attacker who copies your encrypted file can try passwords offline as fast as their hardware allows, slowed only by the PBKDF2 rounds. A short or common password will be guessed. Use a random password of 16 or more characters from a password manager, or a passphrase of four or more unrelated words. Do not reuse a password from another account, and do not store it in the same place as the encrypted file. You can test a candidate with the Password Strength Checker on this site.
Good uses for file encryption
- Protecting scans of passports, IDs and contracts before you upload them to cloud storage.
- Sending sensitive documents by email without relying on the mail provider.
- Backing up tax records and financial files to an external drive.
- Keeping private photos safe on a shared computer.
- Sharing a confidential file with a client where the password is given by phone.
Common mistakes
- Losing the password. There is no recovery.
- Deleting the original too early. Test the decryption first.
- Sending the password with the file.
- A weak password.
- Renaming the file extension. The file still works, but keep .utf1 so you know what it is.
- Using a very large file on a small device. Split it or use desktop software.
Encrypting files before cloud storage or email
Cloud services protect your files in transit and at rest, but they usually hold the keys, so staff, a hacked account or a legal request can still expose them. Encrypting a file yourself before upload means that only the encrypted copy is stored. For several files, put them in a ZIP archive first and encrypt that one file. Keep the password in a password manager and not in the same cloud folder. When you share the file, send the password through a different channel. The recipient can use this page to decrypt it, or you can send them the format notes for use in their own software.
How this compares with other ways to protect files
| Option | Best for | Note |
|---|---|---|
| This tool | Quick one-off protection of single files in any browser | No install, files stay on your device |
| BitLocker, FileVault, LUKS | Whole-disk protection | Protects a device that is switched off or lost |
| VeraCrypt containers | An encrypted folder you keep using | Needs software installed |
| 7-Zip with AES-256 | Archives of many files | Choose the option to encrypt file names |
| Password-protected PDF or Office file | Casual sharing | Strength depends on the program and version |
These are different tools for different jobs, and they work well together. For example, a disk that is encrypted and a file that is encrypted separately give two layers.
Privacy, limits and responsible use
Files are read in slices by your browser and encrypted with its built-in cryptography. The results are created on your device and offered as downloads. Nothing is sent over the network. The tool does not hide the file size or the date you encrypted it, and it cannot protect a device that already has malware. For whole-disk protection use the encryption built into your operating system. Use encryption lawfully and keep a safe record of your passwords.
Related free tools
Use these free online tools together with this one:
- Protect a message with the text encryption tool.
- Create a checksum or hash with the hash generator.
- Check whether a password has leaked with the pwned password checker.
- Reduce a PDF's size before storing it with the compress PDF tool.
- Strip hidden location data from photos with the EXIF data remover.
- Add a licence file to what you share with the license file generator.
Frequently asked questions
How do I encrypt a file online for free?
Choose or drop the file, enter a password twice, and press Encrypt files. Download the encrypted copy, which ends in .utf1.
Is my file uploaded to a server?
No. The file is read and encrypted in your browser and the result is created on your device. Nothing is uploaded.
What encryption does it use?
AES-256 in Galois/Counter Mode, in 1 MiB chunks, with a key derived from your password using PBKDF2 with SHA-256 and a random salt.
How do I decrypt a file?
Open the Decrypt tab, choose the .utf1 file, enter the password and press Decrypt files. The original file name is restored.
What if I forget the password?
The file cannot be recovered. There is no reset and no backdoor, since we never see the password.
Is the file name hidden?
Yes. The original name, type and size are encrypted inside the file. The encrypted copy is named after the original with .utf1 added, so rename it if the name itself is sensitive.
Is the file size hidden?
No. The encrypted file is slightly larger than the original, so its size is visible.
How large a file can I encrypt?
Up to 2 GB per file, depending on your device memory. The tool works in chunks, but the finished file is built in memory before download.
Can I encrypt several files?
Yes. Select several files and each one is encrypted on its own, with the same password, into separate .utf1 files.
Can I use it for photos, PDFs and ZIP files?
Yes. It works with any file type. To protect a whole folder, make a ZIP first and encrypt that.
What happens if someone changes the encrypted file?
Decryption fails. The format detects changed, damaged, reordered or truncated data instead of giving back wrong content.
How strong is the protection?
The cipher is strong. The password is the weak point. Use a long random password or a passphrase of several unrelated words.
Can other software open the files?
Only software that follows the same format. The format is described below, so a developer can write a decryptor.
Is this the same as a password-protected ZIP?
It is stronger than the old ZIP password method, and it uses modern authenticated encryption. For many files, put them in a ZIP first and then encrypt the ZIP here.
Should I delete the original file?
Only after you have opened the encrypted copy successfully and stored the password safely. Deleting a file normally does not erase it from the disk.
What does the summary include?
File names, sizes and the method. It never includes the password.
Is it free?
Yes. It is free online with no sign-up.
Sources and further reading
- NIST FIPS 197 (AES) and NIST SP 800-38D (Galois/Counter Mode) (nist.gov).
- RFC 8018, PKCS #5 Password-Based Cryptography, for PBKDF2 (rfc-editor.org).
- OWASP Password Storage Cheat Sheet, for PBKDF2 round guidance (owasp.org).
- Hoang, Reyhanitabar, Rogaway and Vizar, Online authenticated-encryption and its nonce-reuse misuse-resistance, for chunked (STREAM) designs.
- W3C Web Cryptography API (w3.org).
Sources were consulted in October 2026. Standards and rules can change, so always check the official page for your situation.