Encrypt a file with a passphrase

With AES-256-GCM, the authenticated encryption built into your browser (Web Crypto). The 256-bit key is derived from your passphrase with PBKDF2-HMAC-SHA-256 and 600,000 rounds over a random 16-byte salt, so the same passphrase gives a different key for every file. Data is encrypted in 4 MB chunks, each with its own nonce and authentication tag, and the chunk index and a final-chunk flag are authenticated too, so a reordered, dropped, appended or altered chunk is detected on decryption. The original file name, size and modified date are stored inside the encrypted data, not in the clear. The downloaded file itself is named after the original with .mxenc added, so that outer name is visible to anyone who receives it; rename the file before sharing it if the name is sensitive.

A 35-byte header followed by chunk records, all integers little-endian. Header: bytes 0 to 4 are the ASCII text MXENC; byte 5 is the version (1); byte 6 is the key derivation (1 = PBKDF2-HMAC-SHA-256); bytes 7 to 10 are the iteration count; bytes 11 to 26 the salt; bytes 27 to 30 a random nonce prefix; bytes 31 to 34 the chunk size in bytes. Each record is a 4-byte length followed by AES-256-GCM ciphertext ending in its 16-byte tag. Record 0 is the metadata JSON {name, size, lastModified}; records 1 onwards are the data, chunk size bytes each except the last. The nonce of record i is the 4-byte prefix followed by i as 8 little-endian bytes. The additional authenticated data of record i is the 35-byte header, then i as 8 little-endian bytes, then one byte that is 1 on the final record and 0 otherwise. The passphrase is UTF-8, NFKC-normalised. A short Python script with the cryptography library decrypts such a file in about twenty lines; the format is also implemented in this site's open engine file.

The file cannot be opened, by you, by us or by anyone else. There is no account, no key stored anywhere and no reset. Keep the passphrase in a password manager or written down in a safe place.

At least 8 characters are required; 12 or more, made of several unrelated words, are recommended. The minimum and the estimate both count the passphrase as its key is made from it, after Unicode normalisation (NFKC): full-width letters count as ordinary letters, and ffi as the three letters ffi. The strength under the field estimates, on your device, how many guesses an attacker would need, and says what it found. It recognises words on its lists: about 8,000 common passwords from leaked lists, about 16,000 English words from Wikipedia and our own list of the 330 commonest English words, and about 13,000 English first names and surnames from US census data, also written backwards or with look-alike characters such as @ for a. It also recognises keyboard patterns, repeats, sequences and dates. Letters that read like English but are not on its lists count as one English word. It does not recognise words of other languages: each Chinese, Japanese or Korean character counts as a cautious 4 bits, and letters of other scripts as random letters, so a sentence in another language may read stronger than it is. It knows nothing about you: a pet's name or a street counts only if it is on its lists, and a birthday as any date. The suggested passphrase is 20 random letters and digits (about 100 bits).

The file is read into memory and the encrypted output is assembled in memory, so the practical limit is your device's memory. Deriving the key takes about a second per file on a laptop, by design: the 600,000 rounds slow down guessing.

No. It exists so that your passphrase never leaves your device, so it runs only in your browser and is not offered on our API.

No. The page loads a small script into your browser and every operation runs on your device. You can check this yourself in the browser's network panel: after the page has loaded there are no upload requests. Closing the tab discards the file.

No. These basic tools are free and store nothing on our servers. The only limits are the tool's own: passphrases of at least 8 characters. Within them, the practical limit is your device's memory.

Nothing you open or type. While the tab is open, the tool pages keep a short list of the steps taken in it, in the tab's session storage: the step (page opened, started, succeeded, first success, used again or failed), the tool's name, the time, how many files were used and, for a failure, an error code; never a file name, the contents of a file or your text. It holds at most the latest 200 steps, and the browser deletes it when the tab closes. The page never sends it. Where a Report a problem button is shown, you can attach the last 20 steps to your report; nothing is attached unless you tick that box. In local storage the page keeps only choices you made: a Light or Dark theme until you choose System again, the language you picked with the EN / 中文 switch if it differs from your browser's language, and this tool in your recently used list if you switched that list on at the tools page.