How to use Encrypt text
- Type or paste the message and choose a password.
- Select Encrypt, then copy the encrypted text or a share link.
- Send the password separately. The recipient opens the link or pastes the text, enters the password and selects Decrypt.
Send a secret without trusting the channel
Wi-Fi passwords, door codes, bank details, recovery codes and private notes often travel through email, chat apps and support tickets, where they stay in inboxes, backups and search indexes for years. Encrypting the message first means anyone who later finds it sees only scrambled text. Only someone with the password can read it.
Type the message, choose a password and select Encrypt. You get a block of text starting with wai1., which you can paste anywhere, and a share link that opens this page with the encrypted text filled in. Send the password by a different route than the message, for example the link by email and the password by phone or in person.
How it's protected
Encryption uses AES-256 in GCM mode, the same cipher that protects HTTPS traffic, through your browser's built-in WebCrypto. The key is derived from your password with PBKDF2-SHA-256 over 600,000 rounds, the figure OWASP recommends, and a random salt, which makes guessing passwords slow. Every message gets its own random salt and nonce, so encrypting the same text twice gives different results, and GCM's authentication tag means a wrong password or an altered message is rejected rather than decrypted into nonsense.
The protection is only as strong as the password. A passphrase of four or more random words is easy to read out over the phone and far harder to guess than a short password with symbols.
Nothing leaves your device
The message is encrypted and decrypted in your browser; neither the text nor the password is sent to us or stored anywhere. In a share link, the encrypted text sits after the # sign, the part of a web address that browsers never send to servers, and this site's analytics record only the page's address without it. When someone opens a share link, the encrypted text is read and then removed from the address bar.
Because nothing is stored, a forgotten password can't be reset: the message is gone for good.
Questions
- How secure is it?
- The text is encrypted with AES-256-GCM, with a key derived from your password by PBKDF2-SHA-256 over 600,000 rounds and a random salt, all by your browser's built-in WebCrypto. Without the password it can't be read, and any change to the encrypted text is detected. The weak point is the password: use a long passphrase.
- Does the share link send my message to your server?
- No. The encrypted text sits after the # in the link, a part browsers never send to servers, and our analytics only ever record the page's address, not that part. Even so, the link is useless without the password.
- What if I forget the password?
- The message can't be recovered. Nothing is stored anywhere, so there is no reset; that's what makes it private.