Encrypt / Decrypt

What it's for

Lock text or a file with a password, using AES-256, so only someone with the password can read it. The result is in the same format as the openssl enc command on macOS, Linux and Windows, so either can open what the other makes.

For example, when you need to send someone a document or a set of login details by email, encrypt it here and tell them the password another way, such as by phone.

How to use it

Type a password. For text, type or paste it into Input and choose Encrypt text: the output is Base64, safe to paste into an email or chat. To decrypt, paste that Base64 into Input and choose Decrypt text. For a file, choose it and Encrypt file downloads it with .enc added to its name; Decrypt file downloads the original. The same password and number of iterations must be used both ways.

Iterations sets how many rounds of PBKDF2 turn the password into a key: more makes guessing passwords slower for an attacker. The default, 600,000, is remembered if you change it. The panel at the bottom gives the matching openssl commands.

Example

Type correct horse as the password, keep 600000 iterations, paste this into Input and choose Decrypt text:

U2FsdGVkX1/DdwCq4fHqC73U0XCYExh6/o/LOwMnIEO9WX826RQBZmX69vv8xAvw

The output is From the CLI side. It was made with openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -md sha256 -a.

Good to know

Uses AES-256-CBC with a key and IV from PBKDF2-SHA256 and a random salt, as openssl enc -pbkdf2 does (OpenSSL 1.1.1 or later, or the LibreSSL in macOS). The format can’t detect tampering, and about one wrong password in 256 decrypts to garbage instead of an error. A forgotten password can’t be recovered. OpenSSL’s -a needs Base64 in lines of at most 64 characters, which is how this tool writes it; for one long line, add -A. Files are read into memory, so files of several hundred megabytes or more may fail, especially on phones.