Encrypt Text Online: AES-256 With a Password or a Key
To encrypt text online for free, paste it into Text to Encrypt, type a password, keep AES-256-GCM selected and click Encrypt Text. The tool returns the encrypted text, an initialization vector (IV) and a salt, which you copy as JSON with Copy All (JSON) or save as encrypted-text.json. The encryption is AES with a 256-bit key, run by your browser's built-in Web Crypto API. It happens on your device and nothing is uploaded; you can check the Network tab in your browser's DevTools.
In password mode the key comes from PBKDF2-HMAC-SHA256 with 600,000 iterations, the figure the OWASP Password Storage Cheat Sheet recommends for that algorithm (checked October 2026), and a random 16-byte salt. Every run also uses a fresh random IV, so encrypting the same text with the same password twice gives two different results. To read the output later, load the JSON in the Text Decryption Tool and enter the same password.
Keep one limit in mind: the strength of the result depends on the password. A guessable password can be cracked offline whatever the cipher, and a lost password cannot be recovered. Make a long random one with the password generator or switch to a random 256-bit key.
Text Encryption Table of Use: Settings and Results
| Use case | What you set | What you get |
|---|---|---|
| Protect a private note before saving it to cloud storage | Text, a long passphrase, AES-256-GCM, Base64 | JSON with encrypted, iv and salt |
| Send a secret by email or chat | Text and a password; send the JSON, tell the password by a different channel | A message only the password holder can read |
| Encrypt without a password | Tick "Use a 256-bit key instead of a password", click Generate | A random 64-hex-character key; the JSON has no salt |
| Meet a system that needs CBC | Choose AES-256-CBC | A 16-byte IV and PKCS#7 padding, no tamper check |
| Paste into a script or config file | Output Format Hex | Ciphertext, IV and salt as lowercase hex |
| Test your own AES code | Any text, then decrypt the JSON in your library | Standard AES-GCM or AES-CBC output that any AES library can decrypt (every run uses a new random IV, so two runs never match) |
How big is the output?
The 12-byte text "Meet at noon" produces these sizes, measured with the same routines the tool uses.
| Item | AES-256-GCM | AES-256-CBC |
|---|---|---|
| Encrypted text | 28 bytes (text + 16-byte tag): 40 Base64 or 56 hex characters | 16 bytes (padded to a block): 24 Base64 or 32 hex characters |
| IV | 12 bytes: 16 Base64 or 24 hex characters | 16 bytes: 24 Base64 or 32 hex characters |
| Salt (password mode) | 16 bytes: 24 Base64 or 32 hex characters | 16 bytes: 24 Base64 or 32 hex characters |
Text Encryption Tool Features
- Two AES-256 modes: GCM (authenticated, the default) and CBC (classic, no integrity check).
- Password or key: a password is stretched with PBKDF2-HMAC-SHA256; a custom key must be exactly 64 hexadecimal characters, and spaces are ignored.
- Generate: fills the key box with 32 random bytes from your browser's cryptographically secure random generator.
- Strength estimate: a Weak, Fair, Good or Strong label that penalises common words, keyboard runs and years. It is a guide, not a guarantee.
- Base64 or Hex output: switching only re-encodes the same result, so nothing needs re-encrypting.
- Results never go stale: changing the text, password, key or mode clears the output, so a copied bundle always matches the settings that made it.
- Export: a Copy button for each field, Copy All (JSON), and Download .json, which adds a created timestamp.
- Show password and Reset: an eye button reveals what you typed, and Reset clears the text, password and key.
The JSON holds encrypted, iv, mode, format and keyType, plus salt, kdf (PBKDF2-SHA256) and iterations in password mode. It never includes the password or key. The tool encrypts text only, not files; to turn a file into text first, the Base64 encoder handles files up to 50 MB.
How to Use the Text Encryption Tool
- Type or paste your message into Text to Encrypt.
- Under Encryption Mode choose AES-256-GCM (recommended) or AES-256-CBC, and under Output Format choose Base64 or Hex.
- Enter a Password, or tick Use a 256-bit key instead of a password and type or Generate a 64-character key.
- Click Encrypt Text. The Encrypted Output panel lists the encrypted text, the IV and the salt.
- Click Copy All (JSON) or Download .json, and store the password or key separately.
- To read it again, open the Text Decryption Tool and load or paste the JSON.
Who Can Use the Text Encryption Tool
Anyone who needs to protect a short piece of text before storing or sending it can use it: a private note in a notes app, a note for a family member, or a client detail in an email. Developers use it to produce known-good AES-GCM or AES-CBC samples for their own code, and a JSON formatter makes the exported bundle easy to read.
Related jobs have their own tools. A SHA-256 hash generator fingerprints text without being reversible, the MD5 hash generator is for legacy checksums only, and the Base64 decoder reverses an encoding that never had a secret. For simple letter shifts, the ROT13 and Caesar cipher tool is a puzzle, not protection, and a UUID generator makes unique IDs rather than keys.
Text Encryption FAQs
How do I encrypt text with a password online?
Paste your text into "Text to Encrypt", leave AES-256-GCM selected, type a password and click Encrypt Text. The tool shows the encrypted text, the IV and the salt. Press "Copy All (JSON)" or "Download .json" to keep all three together, and store the password somewhere else. Anyone holding the JSON and the password can decrypt it in the Text Decryption Tool.
Is it safe to encrypt text in an online tool?
It is safe here because the encryption runs in your browser through the Web Crypto API, and your text, password and key are never sent to ZipConvert. You can verify this by opening the Network tab in your browser's DevTools while you click Encrypt Text. Be careful with any other site that cannot show the same: a server that receives your password can read your text.
Is AES-256 encryption secure?
AES with a 256-bit key is the NIST standard published as FIPS 197 and, as of October 2026, no practical attack on it is publicly known. A 256-bit key cannot be guessed by brute force. In practice the weak point is the password: a short or common one can be guessed. That is why the tool stretches passwords with PBKDF2 and shows a strength estimate. Use a long passphrase or a random 256-bit key.
What is the difference between AES-GCM and AES-CBC?
GCM is authenticated encryption: it appends a 16-byte tag, so a wrong password or any change to the encrypted data is detected when you decrypt. CBC only hides the content, pads it with PKCS#7 and has no built-in tamper check. Choose GCM unless another system specifically requires CBC.
What is the difference between password mode and a 256-bit key?
In password mode a 256-bit key is derived from your password and a random 16-byte salt with PBKDF2-HMAC-SHA256, so you only remember the password. In key mode you supply the 256-bit key yourself as 64 hex characters, or click Generate for a random one. There is no salt, and the key is the only way to decrypt, so store it safely.
Can I decrypt the result with OpenSSL, Python or Node.js?
Yes, with any AES-256 library, such as Python's cryptography package or Node's crypto module. For GCM the IV is 12 bytes and the last 16 bytes of the encrypted data are the authentication tag. For CBC the IV is 16 bytes with PKCS#7 padding. In password mode, derive the key with PBKDF2-HMAC-SHA256 using the salt and the iterations value saved in the JSON. The openssl enc command cannot decrypt GCM; for CBC, use a raw key and pass the key and IV in hex with -K and -iv.
What happens if I forget the password or lose the key?
The text cannot be recovered. There is no backdoor and nothing is stored on our side, because encryption happens only in your browser and the page keeps no copy. Store the password or key in a password manager, separately from the encrypted JSON, before you delete the original text.
What is the difference between encryption, Base64 encoding and hashing?
Encryption scrambles text with a secret so only the key holder can read it back. Base64 is a reversible encoding with no secret, so anyone can decode it. A hash such as SHA-256 is a one-way fingerprint that cannot be turned back into the text. Only encryption protects the content while still letting you recover it.