Private by design: messages, keys and passwords never leave your browser
Encrypt & decrypt
Text or files, with AES, ChaCha20-Poly1305, Triple DES, DES and RC4, using a password or a raw key and IV. Password mode uses OpenSSL's format, so it also opens openssl enc files and CryptoJS strings.
recommendedThe standard for symmetric encryption. With GCM it also detects tampering.
Authenticated: decryption fails if anything was changed. Never reuse a nonce with the same key.
openssl enc -pbkdf2. Slow on purpose, which makes guessing the password expensive. The output is OpenSSL's format: "Salted__", an 8-byte random salt, then the ciphertext and the 16-byte tag (openssl enc can't do authenticated modes, so this part is specific to this tool).
Optional. Authenticated but not encrypted, e.g. a user ID or header. The same text is needed to decrypt.
Plaintext
Ciphertext
Tools
AES encryption
AES-128, 192 or 256 in GCM, CBC, CTR, CFB, OFB or ECB, with a password or a key and IV.
OpenTriple DES & DES
Decrypt (or make) 3DES and DES data for legacy systems, in CBC, ECB, CFB, OFB or CTR.
OpenChaCha20-Poly1305
The modern authenticated cipher from TLS 1.3 and WireGuard, plus XChaCha20 with 24-byte nonces.
OpenAlgorithms
| Algorithm | Key | Block | Status | Notes |
|---|---|---|---|---|
| AES-256 | 256 bits | 128 bits | recommended | The standard for symmetric encryption. With GCM it also detects tampering. |
| AES-192 | 192 bits | 128 bits | ok | AES with a 192-bit key. Rarely used; pick AES-256 or AES-128. |
| AES-128 | 128 bits | 128 bits | recommended | AES with a 128-bit key. Still secure and slightly faster than AES-256. |
| ChaCha20-Poly1305 | 256 bits | stream | recommended | A modern authenticated cipher (RFC 8439), used in TLS 1.3, WireGuard and SSH. Fast without AES hardware. |
| XChaCha20-Poly1305 | 256 bits | stream | recommended | ChaCha20-Poly1305 with a 24-byte nonce, long enough to pick at random without worrying about repeats. |
| Triple DES (3DES) | 192 or 128 bits | 64 bits | legacy | DES applied three times. Disallowed by NIST for encryption since 2024; only for old systems (payment terminals, legacy files). |
| DES | 64 bits | 64 bits | broken | The 1977 standard. Its 56-bit key can be brute-forced in a day. Only for reading old data. |
| RC4 | 40–2048 bits | stream | broken | A stream cipher with known biases, banned in TLS (RFC 7465). Only for reading old data. |
Triple DES's 168-bit key gives about 112 bits of real security; a 112-bit (two-key) 3DES key gives about 80.
Frequently asked questions
Is it safe to type my secrets here?+
Encryption and decryption run as JavaScript in your browser tab: nothing you type is sent to a server, logged or stored. Even so, treat real production keys with care and prefer encrypting on the machine that owns them.
Password or key: which should I use?+
Use a password when a person will type it in. The key and IV are derived from it with PBKDF2 and a random salt, in the same format as openssl enc, so OpenSSL can decrypt it too. Use a raw key when a program will decrypt the data: generate a random key, store it securely, and send the IV with the ciphertext.
How do I decrypt a CryptoJS string that starts with U2FsdGVkX1?+
That's Base64 for "Salted__", OpenSSL's password format, which CryptoJS uses for CryptoJS.AES.encrypt(text, "password"). Choose Decrypt, AES-256, CBC, Password, and the "EVP MD5" key derivation, then enter the password. CryptoJS.TripleDES works the same way with Triple DES.
Why does decryption fail with "the padding is wrong"?+
With CBC and ECB, a wrong key, password, IV or key derivation setting produces garbage, and the padding check at the end is what notices. Check every setting matches how the data was encrypted, including the mode, key size and (for passwords) the iteration count.
Can I encrypt and decrypt files?+
Yes. Switch the input to File and drop in any file. You get a .enc file to download, saved as raw bytes (like openssl enc) or as Base64 text. Decrypting gives the original back with its name. In password mode the files work with OpenSSL too: openssl enc -d -aes-256-cbc -pbkdf2 -iter 600000 -in report.pdf.enc -out report.pdf. The whole file is held in memory, so very large files (gigabytes) are better done with OpenSSL.
Which algorithm should I use?+
AES-256-GCM or ChaCha20-Poly1305. Both are authenticated: decryption fails if the data was changed, which CBC, CTR and the others can't tell you. Use a new random nonce for every message. Triple DES, DES and RC4 are only here for reading old data.
Why is the output different every time?+
A random salt (with a password) or a random IV (with a key) is used for each encryption. That's on purpose: it stops anyone telling that two ciphertexts hold the same message. Both still decrypt to the same text.