Browse tools

AES-256 Encrypt & Decrypt

Lock a message or a file with a passphrase so only people who know it can read it. Encryption happens in your own browser with AES-256: your text, files and passphrase are never uploaded.

Everything happens on this device using your browser's built-in encryption. Nothing you type or open here is sent to our server or saved.

Text to encrypt

Or drop a file here to encrypt it (up to 35 MB, never uploaded)

Passphrase

Choose a passphrase
Format

How it works

  • AES-256 is the encryption used by banks, governments and your phone. The "256" is the size of the key in bits: far too many possible keys for any computer to try them all.
  • Your passphrase becomes the key. We run it through PBKDF2-HMAC-SHA256 600,000 times, the figure OWASP has recommended since 2023 (in its Password Storage Cheat Sheet). That makes every guess slow for an attacker. A random salt means the same passphrase gives a different key every time.
  • Tampering is detected. The standard format uses AES-GCM, which adds a check to the encrypted data. If a single character is changed, or the passphrase is wrong, decryption stops rather than giving you altered data. It can't tell which of the two happened.
  • Nothing leaves your device. The encryption is done by your browser's built-in Web Crypto. You could go offline once the page has loaded and it would still work.
  • Text comes out as a block starting "BEGIN OSIR ENCRYPTED MESSAGE" that's safe to paste into an email. Files come out as a .osir file with the original name and type stored inside, so decrypting restores them.

Keeping it safe

  • If you lose the passphrase, the data is gone. We never see or store it, and there's no reset or back door. Keep it in a password manager.
  • Share the passphrase a different way. Email the file, then phone or text the passphrase. Never put both in the same email: anyone who gets into the mailbox would have everything.
  • Use a long passphrase. Six or more random words is strong and easy to type. Select "Generate a strong passphrase" for one.
  • The size isn't hidden. Encrypted data is about the same size as the original.
  • For sending something once to a person in front of another computer, the Secure Shared Clipboard may be quicker. To check a passphrase you already use, try the Password Strength Tester.

OpenSSL compatible mode

  • This makes exactly what the openssl command makes, so anyone can decrypt it without this website. OpenSSL is built into macOS and Linux, and comes with Git for Windows.
  • To decrypt a file:
openssl enc -d -aes-256-cbc -pbkdf2 -iter 600000 -md sha256 -in report.pdf.enc -out report.pdf
  • To decrypt a message, save it as message.txt and add -a:
openssl enc -d -aes-256-cbc -pbkdf2 -iter 600000 -md sha256 -a -in message.txt
  • To encrypt with OpenSSL so this page can decrypt it:
openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -md sha256 -salt -in report.pdf -out report.pdf.enc
  • Why it isn't the default: CBC mode isn't authenticated. If someone changes the encrypted data, it still decrypts, just to something different, and a wrong passphrase can occasionally produce nonsense instead of an error. The standard format catches both.
  • Stick to plain letters, numbers and punctuation in passphrases for OpenSSL. Some terminals, especially on Windows, change accented letters and symbols such as the pound sign before OpenSSL sees them.

Why some files are refused

  • This tool is for documents, photos, spreadsheets and archives of data. Programs and scripts are refused, such as .exe, .msi, .bat, .cmd, .ps1, .vbs, .js and .jar files, plus shortcuts (.lnk), screensavers (.scr), HTML applications (.hta), disk images (.iso, .img) and macro-enabled Office files (.docm, .xlsm).
  • Why: email filters and antivirus can't look inside encrypted files, which is exactly why criminals send malware in password-protected files. We don't want to help with that.
  • Disguises are caught too: double extensions such as invoice.pdf.exe, names with hidden right-to-left or invisible characters, names padded with spaces, programs renamed to look like something else (we check the contents, not just the name), and zips with programs inside.
  • Decrypted files are always downloaded, never opened in the browser, and the same checks apply to them.

Technical details

  • Key: PBKDF2-HMAC-SHA256, 600,000 rounds, 16-byte random salt, 256-bit key. Passphrases are Unicode NFC normalised, then UTF-8.
  • Cipher: AES-256-GCM with a random 12-byte IV and a 128-bit tag.
  • Header: OSIR, version 1, KDF 1, cipher 1, rounds (32-bit big-endian), salt length and salt, IV length and IV. The whole header is authenticated as additional data, so it can't be changed either.
  • Inside the encryption: a type byte (1 text, 2 file), then for files the name and MIME type, then the content.

OpenSSL format

  • Salted__, an 8-byte random salt, then AES-256-CBC with PKCS#7 padding.
  • The key and IV are the first 32 and next 16 bytes of PBKDF2-HMAC-SHA256 output (600,000 rounds) from the passphrase's UTF-8 bytes, the same as -pbkdf2 -iter 600000 -md sha256.
  • Messages use OpenSSL's -a base64, 64 characters a line.
  • Older OpenSSL commands without -pbkdf2 use a weak MD5-based key and aren't supported.

More free tools