Cryptor (AES-256) — Tips & Tricks

Back to overview: Cryptor (AES-256) · Open the live tool: www.jpkc.com/tools/cryptor/

Cryptor is quick to operate — but with encryption, the devil is in the details. This page collects what matters in practice. The technical groundwork for it is in the manual.

The password is everything — and not recoverable

Cryptor is symmetric encryption: the same password encrypts and decrypts. From that follows the single most important rule:

Lose the password and the ciphertext is irretrievably lost. There's no reset, no back door, no recovery — that's not a flaw, it's the point of genuine encryption. Record the password somewhere safe (a password manager — the Copy password button helps) before you hand the ciphertext on.
A weak password makes the strong crypto worthless. AES-256 and 600,000 PBKDF2 iterations help little if the password is secret123. Use the generator behind the key icon or a long, unique password from your manager.
A minimum of 8 characters is what the tool demands to encrypt — that's a floor, not a guideline. For confidential content, use considerably more.

Character password or passphrase?

The generator offers both, and both are secure — the choice depends on how the password travels:

Password · 32 characters (≈ 202 bits) is the right pick when the password comes out of a password manager by copy and paste anyway. 64 characters add practically no extra protection, but they don't hurt either.
Passphrase · 6 words (≈ 78 bits, badge "strong") or 8 words (≈ 103 bits, "very strong") is the better choice when a person has to read the password out over the phone or type it in. crumb-velvet-unfold-stucco-lagoon-ripple is far easier to dictate than 32 special characters.

The bit value next to the field is exact for generated passwords. For passwords you type yourself it's followed by "(estimate)" — a rough guess that does spot and penalize well-known patterns like Summer2024!, but doesn't see every weakness. A "strong" for a self-invented password is no free pass.

Transmit password and ciphertext separately

The ciphertext is only as secure as the channel the password travels on. Never send the two together in the same message. Proven approach: the ciphertext by email or chat, the password by another route (phone, Signal, in person). Anyone who intercepts both in the same inbox otherwise has everything.

Password hidden or visible

The password field is hidden by default. So that an invisible typo can't lock you out of your text forever, Cryptor then asks for the password a second time in Repeat password when you encrypt. Reveal it with the eye button and the repeat is dropped — and a generated password is shown straight away anyway.

A visible password is convenient, but mind shoulder surfers, screen sharing, and screenshots: hide it again before you share your screen. Tidy up with Clear when you're done — it wipes the Message field, the password, and the repeat field in one go.

Undo instead of panic

A click on Encrypt, Open, or Clear replaces the field content. No reason to worry: Undo (or Ctrl+Z, as long as you haven't typed anything further in the field) steps back up to 20 times, password included. Say you accidentally encrypted an already encrypted text a second time — Cryptor does ask in that case, but a quick click happens — Undo reverts it at once. The history doesn't survive a page reload, though.

GCM detects tampering — use that

Because Cryptor uses AES-256-GCM (authenticated encryption), a successful decryption of formats v2 and v1 is also an integrity proof: if even a single byte of the ciphertext had been altered — for v2, the iteration count in the header as well — decryption would fail. So if such a text decrypts, you can be sure it's unchanged and comes from someone who knows the password. If Decrypt fails, either the password is wrong or the ciphertext is damaged (e.g. a character lost while copying).

This doesn't apply to legacy texts (U2FsdGVkX1…): they use AES-256-CBC without an authentication tag. All Cryptor checks there is whether padding and UTF-8 are consistent — so a successful decryption proves neither that the text is unchanged nor where it came from. One more reason to migrate such texts.

Line breaks and spaces that a mail client slips into the block, on the other hand, are harmless — Cryptor strips them before decrypting.

Every run produces a different ciphertext

Don't let it throw you: encrypting the same text with the same password twice gives you two different results. That's correct — the salt and IV are newly random on each run. Both decrypt with the password to the same plaintext. An identical result would, on the contrary, be a warning sign. Only the prefix cryptor:v2:600000: stays the same.

Migrate legacy messages

If you come across old ciphertext — starting with U2FsdGVkX1… (legacy) or bare Base64 without the cryptor: prefix (format v1) — Cryptor still reads it but no longer produces the old format. Treat such finds as a migration task: Decrypt (the format is detected automatically) → follow the hint "Encrypt it again to upgrade it to the current, stronger format" → click Encrypt straight away to store the message in format v2 with 600,000 iterations. That way you gradually move everything onto the current standard.

It pays off especially for legacy texts: their key derivation is a single MD5 pass per key block instead of 600,000 PBKDF2 rounds — so an attacker can try passwords against them far faster.

Compatibility: decrypting without Cryptor

Format v2 is openly documented and uses standard algorithms only — the Format & decrypting without this tool card describes it completely and provides ready-made scripts for Node.js, Python, and PHP. For legacy texts, the Older formats tab has an openssl command.

For archives, that means: keep the matching script next to your encrypted files. Then you get your data back even if this website is gone one day. The opposite direction — decrypting texts produced with openssl enc in Cryptor — the tool supports only for the old Salted__ format with AES-256-CBC and MD5 key derivation (-md md5).

No history — save results in time

For security reasons, Cryptor stores nothing between runs. Reload the page or close the tab and everything is gone — the undo history included. So save a ciphertext or a decrypted text in time with Copy (clipboard) or Save before you leave the page. Save picks the file name itself: encrypted.txt for ciphertext, plaintext.txt for plaintext — a glance at the name tells you whether you're saving the right thing.

Text only, no binary files

Cryptor is built for text. It refuses images, PDFs, or ZIP archives on opening rather than destroying them by reading them as text; files are capped at 20 MB. For a binary file you need a different tool — or you encode it as Base64 text first and encrypt that. In that case, though, Cryptor asks "This already looks encrypted. Encrypt it again?", because bare Base64 looks like the old format v1: confirm with OK, and use the Encrypt button rather than Ctrl+Enter — the shortcut would treat the text as ciphertext and try to decrypt it.

The browser needs HTTPS

The Web Crypto API only runs in a secure context, and Cryptor additionally computes in a web worker. If the buttons stay greyed out and a message says your browser doesn't support modern encryption, check that you really opened the page over HTTPS (https://www.jpkc.com/tools/cryptor/) and in a current browser.

Combining with other JPKCom tools

Password & key generator — when you want more control over the password's length and character set than the built-in menu offers.
Hash generator — put a checksum over the encrypted file to spot corruption later, before you even enter the password. If you need a password hash for storing logins (bcrypt, Argon2, PBKDF2), that's the place too — Cryptor is the wrong tool for it, because its encryption is reversible.
QR code generator — hand over a short ciphertext as a QR code (the password separately, of course).
PKI / certificates — when a shared password isn't practical and you need asymmetric cryptography.

The full reference is in the manual, concrete walkthroughs in the examples. You can try everything in the tool.