Encrypt / Decrypt
Encrypt and decrypt text or files entirely in your browser using OpenSSL compiled to WebAssembly — your keys and data never leave the page. Pick a cipher family (AES, ChaCha20, SM4, Camellia, ARIA, or a legacy cipher such as 3DES), a mode of operation and a key size, then run it.
Modes fall into two camps. Authenticated (AEAD) modes — AES-GCM, AES-CCM, ChaCha20-Poly1305 — protect both confidentiality and integrity and accept optional Additional Authenticated Data (AAD). Classic modes like CBC and CTR provide confidentiality only, so they need a separate MAC for integrity. CBC needs a random IV per message; CTR and GCM use a nonce that must never repeat under the same key.
For public-key encryption, switch to Asymmetric for RSA-OAEP / PKCS#1. Generate a key pair in-app or paste your own, and use “Use as input” to carry a result back and verify a round-trip.
Frequently asked questions
- Is my data uploaded anywhere?
- No. All encryption runs locally in your browser via WebAssembly; nothing is sent to any server.
- Which AES mode should I use?
- Prefer an authenticated mode such as AES-256-GCM for most uses — it protects integrity as well as confidentiality. Use CBC only for legacy interoperability, and always pair it with a MAC.
- What is the difference between an IV and a nonce?
- Both randomise encryption so identical plaintext does not produce identical ciphertext. CBC uses a random IV; CTR and GCM use a nonce that must be unique per message under a given key — never reused.