SITE UNDER CONSTRUCTION. Everything here is provided AS IS, WITHOUT WARRANTIES, to the extent the law allows. It is information, not professional advice. Use at your own risk. Terms and liability limits →

eThorns ES
Menu
Buy us a coffeeEspañoleThorns 2026 · Made in Colombia
← Security & privacyES

Tool 1.14

Encrypt text with a password (AES-256, in-browser)

Encrypt and decrypt messages or notes with a password (AES-256-GCM) in your browser. The result is text you can send anywhere; only the password opens it.

Runs on your deviceRuns entirely in your browser: nothing you type or upload leaves your device.

How to use it

  1. Type your text and choose a strong password (twice).
  2. Press Encrypt and copy the result, which starts with eth1:.
  3. To read it, switch to Decrypt, paste the text and enter the same password.

When encrypting a message makes sense

Encrypt a message when the channel isn't private enough for what you're sending: a Wi-Fi or account password for a colleague by email, bank details in a shared document, recovery codes kept in a cloud note, a private note on a computer other people use. The encrypted result is plain text, so it travels through anything that carries text, and only someone with the password can turn it back.

It's not a replacement for an end-to-end encrypted messenger in day-to-day chats. It's for the times you have to use email, a shared folder or even paper, and still want the content to stay private.

Sending the office Wi-Fi password by email

Type the message, choose a passphrase of five or more random words, type it twice and press Encrypt. The result starts with eth1: followed by a long run of letters, digits and symbols. Encrypt the same text again and the result is completely different, because each time uses a new random salt and IV; both versions open with the same password.

Send the result by email and give the password by phone. Your colleague chooses Decrypt, pastes the text and types the password. If a single character was lost or changed on the way, they get “Wrong password, or the encrypted text was changed or cut off.”: the encryption checks that the text arrived intact. Spaces and line breaks added by email are ignored. Decrypting takes a moment on purpose, which also makes every password guess slow for an attacker.

What encryption doesn't hide

Anyone who sees the result knows that you sent something encrypted, and roughly how long it is. If your phone or computer has malware that records what you type, no encryption helps. And a short password can be guessed by trying many candidates against the text; the page warns below 12 characters.

The format is specific to this tool, so the other person needs this page, or a program built on the same public recipe described in the note under the tool, to decrypt it. It won't open PGP messages or files from other apps. Keep important texts somewhere else too: without the password, the encrypted version is just noise.

FAQ

How secure is this?

It uses AES-256-GCM with a key derived from your password by PBKDF2-SHA-256 with 600,000 iterations and a random salt, all through the browser's Web Crypto API. The weak point is the password: a short one can be guessed, so use a long passphrase.

What if I forget the password?

The text cannot be recovered. We never see your password or your text, and there is no back door or reset.

How do I give the password to the other person?

Through a different channel than the encrypted text: for example, send the text by email and tell them the password by phone or in person.

Can I encrypt files or photos?

No, only text. For files, use a tool made for that, such as an archive program with AES-256 encryption (7-Zip has one).

Does it work without internet?

Yes, once the page has loaded: everything runs in your browser with the Web Crypto API and nothing is sent. You can load the page, turn off Wi-Fi and mobile data, and encrypt or decrypt as usual.

  • 1.1Is it a scam?Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording.
  • 1.2Scammed or hacked? What nowSteps for the first hours after a scam or a hack: a bad link, a shared code, a stolen WhatsApp, money sent.
  • 1.3Is this file safe?See what a file from WhatsApp or email really is and spot attachment tricks: disguised programs, macros, PDF scripts, SMS-reading apps.
  • 1.4Short link expanderSee where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.
  • 1.5Website security scanPassive check of a website's homepage: HTTPS redirect, TLS certificate, HSTS, CSP, clickjacking, cookie flags and security.txt, with a grade and fixes.
  • 1.6SSL certificate checkerCheck any site's SSL/TLS certificate: whether it's valid, when it expires, who issued it, which names it covers and the TLS version in use.
  • 1.7Lookalike domain detectorCheck a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain.
  • 1.8Domain age checkerSee when a domain was registered, when it expires, its registrar and nameservers.
  • 1.9Password generatorRandom passwords (8 to 128 characters) or passphrases, made in your browser with its cryptographic generator.
  • 1.10Certificate decoderPaste a PEM certificate to read its subject, issuer, validity dates, SANs, key type and size, and its SHA-256 and SHA-1 fingerprints.
  • 1.11Leaked password checkCheck if a password appears in known data breaches without sending it: with k-anonymity only 5 characters of its hash leave your device.
  • 1.12Link cleanerStrip utm_, fbclid, gclid, si and other tracking parameters from links before you share them.
  • 1.13Watermark an ID copyStamp who a copy of your ID is for, and the date, across the whole photo or PDF, then download a smaller copy with no photo data.

╌╌ END ╌╌