UtilibyWritten by the Utiliby editorial team · Last updated October 14, 2026 · Rules and formulas reviewed October 2026
What this free text encryption tool does
Sometimes a message is too sensitive for a plain email or chat: a Wi-Fi password, an account recovery code, a note with personal details. This free online text encryption and decryption tool turns your message into scrambled text that only someone with the password can read. It uses AES-256-GCM, the same kind of encryption that protects banking connections and disk encryption, with a key derived from your password.
Everything happens in your browser using built-in cryptography. Your text and your password are never uploaded, so the service cannot read them or recover them. That is also why a forgotten password cannot be reset.
How to encrypt and decrypt text
- Encrypt. Open the Encrypt tab, type the message, enter a strong password twice and press Encrypt text.
- Copy the result. It is a block of Base64 text that you can paste into an email, a note or a file.
- Share the password separately. Use a different channel from the encrypted text.
- Decrypt. Open the Decrypt tab, paste the whole encrypted text, enter the password and press Decrypt text.
The random password button creates a strong 22-character password. Save it in a password manager before you close the page.
How the encryption works
Your password is not used directly. It is stretched into a 256-bit key with PBKDF2 using HMAC-SHA-256, a random 16-byte salt and the number of rounds you choose. The key is then used with AES-GCM and a random 12-byte nonce. GCM both hides the content and adds an authentication tag, so any change to the encrypted text is detected and decryption fails instead of returning damaged text.
| Part | Size | Purpose |
|---|---|---|
| Header | 4 bytes | The letters UT, a version number and a rounds code |
| Salt | 16 bytes | Makes the key unique even for the same password |
| Nonce | 12 bytes | Makes each encryption unique |
| Ciphertext and tag | message length + 16 bytes | The scrambled message and its integrity check |
The four header bytes are also authenticated, and the whole thing is then written as Base64 or hex.
Choosing the password
The encryption is only as strong as the password. An attacker who gets your encrypted text can try millions of passwords offline, limited only by the PBKDF2 rounds. A short or common password will be found. Choose a passphrase of four or more random, unrelated words or a random string of 16 or more characters, and use it for this purpose only. The strength note under the password box gives a quick estimate, and the Password Strength Checker on this site gives a fuller one.
Never send the password with the message. If both travel together, the encryption adds nothing.
When text encryption helps
- Sending a one-time secret over email or chat.
- Storing a private note in a cloud notes app or a shared document.
- Keeping recovery codes or license keys in a plain text file.
- Leaving a sealed message for family that needs a password to open.
- Teaching how symmetric encryption works.
It does not hide that a message exists, who sent it or when. It is also not a replacement for a secure messenger, which also manages keys between people.
Format for developers
To decrypt the text elsewhere, decode the Base64 or hex to bytes. Bytes 0 to 3 are the header: 0x55, 0x54, a version byte (1) and a rounds code (0 for 100,000, 1 for 310,000, 2 for 600,000, 3 for 1,000,000). Bytes 4 to 19 are the salt and bytes 20 to 31 are the nonce. The rest is the AES-GCM ciphertext with the 16-byte tag at the end. Derive a 32-byte key with PBKDF2-HMAC-SHA-256 from the UTF-8 password, the salt and the rounds, then decrypt with AES-256-GCM using the four header bytes as additional authenticated data.
Common mistakes
- Weak password. The most common failure.
- Sending the password next to the message.
- Copying only part of the encrypted text. One missing character makes decryption fail.
- Reusing one password everywhere.
- Not keeping the password. There is no recovery.
- Trusting an unknown tool. Check that a tool works offline, as this one does.
A safe workflow for sharing a secret
- Write the secret in the Encrypt tab and create a long random password.
- Copy the encrypted text and send it by email or chat.
- Send the password by a different route, for example a phone call or a different messaging app.
- The recipient pastes the encrypted text in the Decrypt tab, enters the password and reads the message.
- Both of you delete the message and the password when they are no longer needed.
Splitting the two parts means an attacker has to break into two separate channels. If the person you are writing to cannot receive the password separately, consider a password manager's secure sharing feature instead.
How this differs from HTTPS, disk encryption and secure messengers
HTTPS protects data while it travels between your browser and a website, and then it is gone. Disk encryption protects a device when it is switched off. Secure messengers encrypt each conversation between people and manage the keys for you. This tool does something simpler: it locks a piece of text with a shared password, wherever the text ends up. That makes it handy for notes stored in the cloud, for text sent over an ordinary channel and for learning, but you remain responsible for choosing a strong password and for passing it on safely. It does not verify who the sender is, and it cannot protect a device that already has malware.
Privacy, limits and responsible use
The tool works in your browser and makes no network request for your data. Browser extensions, shared computers and malware on your device can still see what you type, so use a device you trust. The tool protects text only, not file names, timing or metadata. For files, use the File Encryption tool on this site. Use encryption lawfully, and keep a backup of important passwords in a safe place.
Related free tools
Use these free online tools together with this one:
- Create a memorable, strong passphrase with the passphrase generator.
- Generate a random secret or key with the API key generator.
- Test how strong a password is with the password strength checker.
- Share an email link with a pre-filled message using the mailto link generator.
- Compare two versions of a text with the text compare tool.
- Make compressed code readable with the code unminifier.
Frequently asked questions
How do I encrypt text online for free?
Type your message, enter a password twice, and press Encrypt text. Copy the result and send it. The other person pastes it into the Decrypt tab with the same password.
What encryption does this tool use?
AES-256 in Galois/Counter Mode (GCM), with a key derived from your password using PBKDF2 with SHA-256 and a random salt. Each message gets a fresh salt and nonce.
Is my text sent to a server?
No. Encryption and decryption happen in your browser using its built-in cryptography. Nothing is uploaded.
What if I forget the password?
The text cannot be recovered. There is no reset and no backdoor, because we never see the password or the text.
How strong is the encryption?
AES-256 itself is not the weak point. The password is. A short or common password can be guessed offline, so use a long random one or a passphrase of several unrelated words.
What are PBKDF2 rounds?
They are repeated hashing steps that slow down every password guess. More rounds make guessing slower for an attacker, and make your own encryption take slightly longer.
Which number of rounds should I choose?
600,000 is a good default and matches current OWASP guidance for PBKDF2 with SHA-256. Use 1,000,000 for extra protection if the wait is acceptable.
Why does decryption say the password is wrong?
AES-GCM checks that the data is authentic. If the password is wrong, or even one character of the encrypted text was changed or cut, decryption fails.
Can I decrypt it with another tool?
Only a tool that follows the same format. The format is described in the article below, so a developer can write a decryptor in minutes.
Is this the same as end-to-end encrypted messaging?
No. It protects a block of text with a shared password. It does not handle key exchange, identities or forward secrecy like a secure messenger.
How do I share the password safely?
Send it through a different channel from the encrypted text, for example by phone or in person, never in the same email or chat.
Can I encrypt emojis and other languages?
Yes. Text is encoded as UTF-8, so all languages and emojis work.
Why is the encrypted text longer?
It includes a salt, a nonce and an authentication tag, and Base64 adds about a third. That is about 70 characters of extra length.
What is the difference between encoding and encryption?
Encoding such as Base64 just changes the format and anyone can reverse it. Encryption needs the secret key.
Can I use it for passwords or secrets?
It is suitable for short notes. For long-term secrets use a password manager, and never store the password next to the encrypted text.
Can I print or save the result?
Yes. Copy, download or print the summary. When you decrypt, the printed report hides the decrypted text unless you tick the box to include it.
Is it free?
Yes. It is free online with no sign-up.
Sources and further reading
- NIST FIPS 197, Advanced Encryption Standard, and NIST SP 800-38D, Galois/Counter Mode (nist.gov).
- RFC 8018, PKCS #5: Password-Based Cryptography Specification (rfc-editor.org), for PBKDF2.
- OWASP Password Storage Cheat Sheet, for PBKDF2 iteration guidance (owasp.org).
- W3C Web Cryptography API specification (w3.org).
- UK National Cyber Security Centre, Password guidance (ncsc.gov.uk).
Sources were consulted in October 2026. Standards and rules can change, so always check the official page for your situation.