JPKCom DB

Cryptor (AES-256)

Client-side AES-256-GCM encryption of text in your browser with password protection and PBKDF2 — your starting point for the manual, examples, and tips.

Encrypt text without anything leaving your browser

Cryptor (AES-256) encrypts and decrypts text messages with a password — entirely inside your browser. You enter a password and some text, click Encrypt, and get back an encrypted text that starts with cryptor:v2:600000: and that only someone with the same password can turn readable again. To decrypt, you paste the text, supply the password, and click Decrypt.

The key point: neither your plaintext, nor your password, nor the ciphertext is ever sent to a server. The actual cryptography runs through the browser's Web Crypto API — locally, with no account and no installation. And because the format is openly documented, you get your text back even if the website disappears one day: Cryptor ships ready-made decryption scripts for Node.js, Python, and PHP. That makes it a good fit for anything you want to store safely or send over an insecure channel: a note, some credentials, a short confidential message. You exchange the password separately; the ciphertext can travel happily through an email or a chat.

The tool is built for anyone who needs to symmetrically encrypt a piece of text quickly, without reaching for desktop software or a command-line utility: developers who want to hand over a secret snippet safely; admins who need to stash a confidential note; and anyone who finds OpenPGP too heavyweight for the occasion.

What Cryptor does — at a glance

  • Encrypt — turns your plaintext into AES-256-GCM ciphertext in format v2 (cryptor:v2:600000: followed by Base64).
  • Decrypt — makes a ciphertext readable again with the correct password; automatically recognizes the current format v2, the older format v1, and the legacy format from before 2026.
  • Generate a password — the key icon offers random passwords of 32 or 64 characters and passphrases of 6 or 8 words (EFF word list), all generated in your browser.
  • A password field that helps — hidden by default, revealed with the eye button, with a repeat field against typos, a copy button, and a strength indicator in bits.
  • File operations — Open loads a text file into the field (up to 20 MB; binary files are rejected), Save stores the content as encrypted.txt or plaintext.txt, Copy puts it on the clipboard, Clear wipes the field and the password.
  • Undo — steps back through up to 20 operations (encrypt, decrypt, open, clear, generate), also via Ctrl+Z.
  • Keyboard shortcut and drag and drop — Ctrl+Enter encrypts or decrypts depending on the content; dropping a file onto the text area loads it.
  • Decrypting without this tool — the "Format & decrypting without this tool" card describes the format and provides scripts for Node.js, Python, and PHP plus an OpenSSL command for the legacy format.

The crypto under the hood

Cryptor relies on modern, vetted methods throughout rather than home-grown cryptography:

  • AES-256-GCM as the algorithm — an authenticated encryption. That means decryption checks not only the password but also whether the ciphertext is unchanged. Tampered or corrupted data is detected and rejected instead of yielding garbage. The readable format header is protected against tampering in the same way.
  • PBKDF2 with SHA-256 and 600,000 iterations derives the actual 256-bit key from your password. The high iteration count makes brute-forcing passwords expensive. Because the count is stored in the header, a future format can raise it without making old texts unreadable.
  • Random salt and IV per encryption, drawn from the browser's cryptographically secure random generator. The same text with the same password therefore produces a different ciphertext every time.

Exactly how the output is laid out and which parameters apply in detail is covered in the manual.

Architecture: a tool that sends nothing to a server

Encryption, decryption, and password generation happen 100% client-side — plaintext, password, and ciphertext stay in your browser. The heavy lifting runs in a web worker, a background thread, so the page stays responsive even while it chews through several megabytes of text. For passphrases, the tool fetches the EFF word list as a static file the first time it's needed; nothing of yours is transmitted in the process.

For scripts only, there's a small server endpoint that returns a random password via curl (/tools/cryptor/pw/{length}/, rate-limited). The page itself doesn't use it.

Because the Web Crypto API requires a secure context, Cryptor only runs over HTTPS (or locally via localhost). For security reasons the tool also keeps no history — it stores nothing between runs; a cleared or reloaded page really is empty.

Try it now

→ Open Cryptor (AES-256) — enter a password and some text, click Encrypt, done. No account, free, right in the browser. To decrypt, paste the same password and the ciphertext, then click Decrypt.

  • Password & key generator — produce strong passwords and keys in various flavors to use as your Cryptor password.
  • Hash generator — compute checksums and hashes, for instance to verify a file's integrity. Password hashes for storing logins (bcrypt, Argon2, PBKDF2) live there too — unlike Cryptor, they're one-way and can't be reversed.
  • PKI / certificates — for when you need asymmetric cryptography instead of a shared password.

There's more on the sub-pages: the manual with every crypto parameter, the format, and each function, real-world examples, and collected tips & tricks.