Encrypt text with a password

When encrypting a message makes sense

Most of what you send is fine as it is. Encrypting is worth the extra step when the text would cause real harm in the wrong hands, and it has to travel or be stored somewhere you don't fully control:

• Codes and keys for family: a door or alarm code, the Wi-Fi password for a house-sitter, a safe combination.
• Account details for someone helping you: a bank account number for your accountant, a tax ID for a payroll provider, a login a colleague needs once.
• Recovery codes and seed phrases you keep in a notes app, a cloud drive or a shared document, which are not end-to-end encrypted.
• Instructions for later: where important documents are, or what to do in an emergency, kept in a file with the password in a sealed envelope or with a trusted person.

For long or binary content such as a scanned passport, a spreadsheet or a photo, encrypt the file instead: it keeps the file name and handles files of any size.

Try it: a real encrypted message

This message was made with this tool. Copy the block, paste it into the box above, choose Decrypt and enter the password catwalk-encore-resemble-couch-elephant-bacon.

-----BEGIN STOUTNOOK MESSAGE-----
U1RPVVROSwEBAQABAAAAAAADngxKiIxn2yM0ijZ2SdHrtXoWv1GcQ2NyABAAAAAA
6CFs99dSCmtBS7+RfTJSM7a6Fmm8pZ6TdiG9TMzjoDBdGpP+ZdwmUwEi/pbqLo3r
X47/AUu5NQBoVdXunH6oPe3CC1P4x3OXcz10wFAS76qM5PDBEVTY90VwJj9HMUjj
ojyXjYhSu8fLU1i7VTVnvEr9TM5fQqY=
-----END STOUTNOOK MESSAGE-----

The base64 text between the lines holds a short header (the format version, the password settings and a random salt), then the encrypted message and a 16-byte authentication tag. Change one character, or try a password with a single letter wrong, and decryption refuses. Encrypting the same message again gives completely different text, because every encryption uses a new random salt.

Rules for sharing the password

• Never in the same place as the message. If the block goes by email, the password goes by phone, text message, in person or in a different app.
• Agree on it in person once if you exchange secrets with the same person often, such as your accountant, and change it if you think it has been seen.
• Easy to read out beats clever. A passphrase of random words, like those from the passphrase generator, is far easier to say over the phone than "capital K, hash, nine…" and just as strong.
• No hints in the message. "The password is the name of our first cat" helps an attacker more than the recipient.

What this protects, and what it doesn't

The text is encrypted with AES-256-GCM (NIST SP 800-38D) using a key made from your password with Argon2id (RFC 9106), all in your browser. Anyone without the password sees only the block: they can't read the message or change it without the change being detected. It doesn't hide who you are writing to, when, the subject line of your email, or roughly how long the message is. It can't help if your device or the recipient's has malware that reads the screen or the keyboard, and once the recipient has decrypted the message they can copy it like any other text. Not sure your password is strong enough? Test it with the password strength checker, and check it hasn't been exposed in a breach with the password leak check.