Zellio.io

Text Encryptor

Password-protect text with AES-256 encryption, right in your browser.

Runs locallyWorks offlineShare link carries settings, never your data
Send output toBase64 Encode / DecodeCode FormatterRegex Tester & BuilderBuild a workflow from thisOutput stays on this page until you send it.

Frequently asked questions

How strong is the encryption?

It uses AES-256-GCM with a key derived from your password via PBKDF2 — authenticated encryption that is considered secure for protecting sensitive text. AES-256-GCM is the gold standard in symmetric encryption, used by governments, financial institutions, and security-conscious organizations worldwide. PBKDF2 key derivation applies work factor to your password, making brute-force attacks exponentially harder. The authentication aspect (GCM) verifies that encrypted data hasn't been tampered with, ensuring both confidentiality and integrity. This combination is suitable for protecting personal notes, credentials, and other sensitive information you need to store securely.

What happens if I forget the password?

There is no recovery. The password is the only key, and it is never stored, so an encrypted message cannot be decrypted without it. Keep it safe. This is by design — there are no backdoors, no recovery codes, and no way to decrypt a message if you forget the password. The password never leaves your device, so no company or third party can recover it for you. Use a password manager to store your encryption passwords securely, or commit important passwords to memory if they're critical.

Is my message or password uploaded?

Never. Both the message and password stay in your browser; encryption and decryption happen entirely on your device. All cryptographic operations use browser APIs (WebCrypto) that perform encryption locally without any network communication. Your plaintext messages, passwords, and encrypted results never leave your device, making the tool safe for protecting secrets and confidential information. This privacy-first design means you can confidently encrypt sensitive credentials, personal notes, or business data without any risk of exposure through cloud services or third-party servers.

Pro tips

  • Use a generated passphrase rather than one you invented. The cipher is not the weak point; the password almost always is.
  • Send the password through a different channel than the ciphertext. Both in the same email thread protects against nothing.
  • Store the password in a password manager before you encrypt anything you cannot afford to lose — there is no recovery.
  • Decrypt a test copy immediately after encrypting something important, to confirm the password is what you think it is.
  • Remember that this protects the text, not the fact that you sent it; metadata about the exchange is unaffected.

About Text Encryptor

The password is the entire security model: the key is derived from it, nothing is stored, and there is no recovery path. A weak password makes AES-256 beside the point, and a forgotten one makes the text permanently unreadable.

Encrypt a message with a password using AES-256-GCM — the same strong, authenticated encryption trusted for sensitive data — then share the result and decrypt it later with the same password. It is the simple way to protect notes, credentials or messages you need to store or send through an insecure channel.

The key is derived from your password using PBKDF2 at 150,000 iterations, which is what makes a short password expensive to attack rather than instant. Without the correct password the ciphertext cannot be read, and there is no reset.

AES-256-GCM is authenticated encryption, which matters more than the key size for most real uses. Beyond keeping the content secret, it detects tampering: altering a single byte of the ciphertext makes decryption fail outright rather than quietly producing different plaintext. That property is what makes it safe to send an encrypted blob through a channel you do not control, because a modified message is rejected rather than misread.

The password is the whole security model, and the arithmetic is unforgiving. Key derivation stretches it with PBKDF2 so each guess is expensive, but stretching only multiplies the attacker's cost — it cannot manufacture entropy that was never there. A short or common password remains guessable no matter how strong the cipher behind it, so the practical advice is a long random passphrase from a generator rather than something memorable. There is also no recovery path by design: no reset, no hint, no copy of the key anywhere.

Common use cases

  • Sending a credential or recovery code to a colleague through a channel you do not consider private.
  • Storing sensitive notes in a synced notes app or cloud drive without trusting the provider with the contents.
  • Keeping a private journal entry or record inside an otherwise shared document.
  • Passing information to someone who has no compatible encryption software, since decrypting needs only a browser.
  • Archiving details you need to retain but not read often, where the risk of exposure outweighs the convenience of plain text.
How it comparesGPG and age are the right tools for keys, identities and signed messages, and both assume software installed at each end. A password and a browser is a lower bar to clear when the recipient is not technical and the secret is one paragraph long.