Text Encryption

AES-GCM 256 with a passphrase. Everything runs in your browser — no text is ever uploaded.

⚠ Read this before you encrypt anything.

A lost passphrase means the data is gone. There is no reset, no recovery key, and no backdoor — nobody, including Zion Tech Group, can decrypt your blob without the exact passphrase.
This tool is for casual use — notes, snippets, a string you want to paste somewhere semi-public. It is not for regulated secrets: no health records, payment card data, credentials for production systems, or anything under HIPAA, PCI-DSS, GDPR-sensitive or similar obligations.
Your passphrase is only as strong as you make it. A short or reused passphrase can be brute-forced offline by anyone holding the blob.

How it works

Your passphrase is stretched into a 256-bit key with PBKDF2-HMAC-SHA-256 using 200,000 iterations and a fresh random 16-byte salt. The text is then encrypted with AES-GCM using a fresh random 12-byte IV, which also authenticates the ciphertext — tampering or a wrong passphrase is detected rather than producing garbage.

The output is a single self-contained base64 blob laid out as salt (16 bytes) || IV (12 bytes) || ciphertext + GCM tag. Everything needed to decrypt except the passphrase is inside the blob, so you can paste it anywhere and bring it back here later.

Because the salt and IV are random, encrypting the same text twice with the same passphrase gives two completely different blobs. That is expected and correct.

Encrypted Output

How it works