Encrypt a File with a Password

Password-protect any file with real AES-256-GCM encryption in your own browser tab. No upload, no account, and no server ever sees the file.

🌐 Español

Drop your files here (any file type)

🔒 Private by design: your files are processed locally in your browser and never uploaded to any server.

Written and maintained by Last updated

The exact cipher stack, named

Vague claims are worthless in a page about encryption, so here is precisely what runs, all of it through the browser’s own Web Crypto implementation rather than a bundled library.

The cipher is AES-256-GCM, meaning a 256-bit key and Galois/Counter Mode, an authenticated mode that produces a tag detecting any modification of what it protected. The key comes from your passphrase through PBKDF2 with HMAC-SHA-256 at 600,000 iterations, which is the figure OWASP publishes for that combination. Each encryption generates a fresh 16-byte salt and a fresh 12-byte nonce from the browser’s cryptographic random source, so encrypting the same file twice with the same passphrase produces two completely different outputs. Reusing a nonce under one key is the classic way to destroy AES-GCM, and there is no code path here that can do it.

One consequence of that design is worth stating. Key derivation runs exactly once per file, not per block, so the 600,000 iterations are paid once regardless of whether the file is a text note or a disk image.

Inside the .enc container, byte by byte

The output is a plain binary file with a small, fully documented header in front of the ciphertext:

"SFXENC"          6 bytes, ASCII signature
version           1 byte  (currently 1)
iterations        4 bytes, big-endian uint32
salt             16 bytes
nonce            12 bytes
name length       2 bytes, big-endian uint16
original name     that many UTF-8 bytes
ciphertext        the file, plus a 16-byte authentication tag

That header is not merely stored alongside the ciphertext, it is fed to the cipher as additional authenticated data. Editing a single byte of it, including the file name or the iteration count, makes decryption fail exactly as loudly as a wrong passphrase would. Reading the iteration count back out of the file rather than assuming today’s constant is what keeps old files openable if the number is ever raised.

The header is also where the honest limitation lives. The original file name is stored in plain bytes so decryption can restore it automatically, which means it is protected against tampering but not hidden. Anyone who inspects the raw file can read that 2025-tax-return.pdf was the input. Rename before encrypting if the name alone gives too much away.

Locking a document before it goes to cloud backup

  1. Put the passphrase on the first line of a plain .txt file. Only the first non-blank line is read, and it is trimmed, so leading and trailing spaces are not part of the password.
  2. Leave Mode on Encrypt. Switching it to Decrypt reverses the operation later.
  3. Drop both files together into the box, which accepts any file type. Exactly two are needed, the target and the password text file, and the tool sorts out which is which by extension, so order does not matter.
  4. Click Encrypt a File with a Password.
  5. Use the download link that appears. The result is your original file name with .enc appended, and decrypting it later gives back the original name rather than a stripped one.

The passphrase arrives as a .txt file, and what that costs

Tool options on this site are dropdowns, numbers and checkboxes; there is no free-text field a password could be typed into. Supplying it as a second file is the same workaround Password Protect a PDF uses, and it has one sharp edge worth knowing before you hit it.

If the file you want to encrypt is itself a .txt, both uploads look like the password file and the tool refuses to guess. The fix is to change the target’s extension first, or to wrap it in an archive with Create ZIP Files Online and encrypt the .zip instead, which is also the tidier answer when you want several files under one passphrase. Bear in mind that the passphrase file sits on your disk in plain text until you delete it, which is worth a moment’s thought if the machine is shared.

A failed decryption tells you less than you would like

When decryption fails you get no output file at all, which is the correct behavior for an authenticated cipher. Nothing half-decrypted is ever offered, and there is no silent fallback to garbage bytes. What you will not get is a precise diagnosis. The shared file interface catches every error and shows one generic sentence about the file being invalid, sending the real message to the browser console, and even that real message cannot separate a wrong passphrase from a corrupted or edited file, because the authentication tag treats them identically.

There is a rough edge in the aftermath, too. After a failed run the page keeps the two files you selected and offers no reset button, so the cleanest way to try again with a different passphrase file is to reload the page. One distinction the code does still draw internally is between your file and a stranger’s, since anything that never came from this tool fails at those six signature bytes long before the cipher is reached, even though the banner you see is worded the same.

What this protects, and what it does not

Confidentiality of the file’s contents is real and rests on a well understood construction. What it rests on more heavily is your passphrase, since an attacker with the .enc file can guess offline for as long as they like, and 600,000 iterations makes each attempt slow without making a common word safe. Generating one with the Passphrase Generator, which strings together words from the EFF list, or the Password Generator at its default sixteen characters, is a bigger security win than anything else on this page.

Three things are outside the guarantee. The file name is visible, as described above. The file’s approximate size is visible, since the ciphertext tracks the plaintext length. And a compromised device is a compromised device, because encryption performed on it has to see the plaintext.

For related work, File Checksum Verifier confirms a decrypted file matches what you expect, and Encrypt a Text Message with a Password applies the identical primitives to a short message, handing back a Base64 block you can paste into an email instead of a file you have to attach. The trade-off against Password Protect a PDF is worth naming as well, since that one produces a file any PDF reader opens with the password, using the PDF specification’s own AES-128 security handler, whereas the container here is stronger but only this page can open it.

See it in action

Screenshot of the Encrypt a File with a Password tool with sysfenix-sample.png (466 KB) loaded, Mode set to Encrypt
Encrypt a File with a Password mid-process: sysfenix-sample.png (466 KB) loaded, Mode set to Encrypt.
Screenshot of the Encrypt a File with a Password result screen showing sysfenix-sample.png.enc ready to download (466 KB)
The finished result: sysfenix-sample.png.enc ready to download (466 KB). The download link is a local blob URL — the file never leaves your device.

Frequently asked questions

What happens to my passphrase once the run finishes?

The first non-blank line of the text file is read, trimmed of surrounding spaces, and handed to PBKDF2 to derive a 256-bit key. It is never written into the output, never saved in the browser, and never sent anywhere, so it disappears with the tab. The salt, the iteration count, the nonce, the original file name and the ciphertext are what end up in the encrypted file, and the passphrase is not among them, which means nobody can recover it from the file, only try to guess it.

Why does a wrong passphrase not produce a message saying so?

The processing code does raise a specific message, but the shared file interface on this site replaces every error it catches with one generic sentence and logs the detailed one to the browser console. Underneath that, AES-GCM cannot tell a wrong key from a flipped bit or an edited header anyway, because all three fail the same authentication check. In practice, no download link appearing means the passphrase, the selected mode or the file itself is wrong.

Can any other program open the .enc file this produces?

No. The container layout is specific to this tool, starting with the six ASCII bytes SFXENC, so only this page (or code written to reproduce the same header and the same PBKDF2 and AES-GCM parameters) can read it back. If long-term portability matters more than convenience, an established format such as OpenPGP or an encrypted archive is the safer choice, because you are not betting on one web page still existing.

How much larger does encrypting make the file?

57 bytes plus the length of the original file name in UTF-8. That comes from a 41-byte fixed header holding the signature, format version, iteration count, salt, nonce and a two-byte name length, then the stored name, then the 16-byte authentication tag the cipher appends. Encryption does not compress, so an already-compressed file gains only that small constant.

Is 600,000 PBKDF2 iterations enough on its own?

It raises the cost of every guess an attacker makes, and it is the count OWASP publishes for PBKDF2 with HMAC-SHA-256, but it only multiplies a small number by a constant if the passphrase itself is guessable. Four or five genuinely random words beat a mangled dictionary word here by an enormous margin. The count is stored in each file's header rather than assumed, so files encrypted today still open if that number is raised in future.

Is there a size limit on the file I can encrypt?

Nothing is imposed by the page, so the practical ceiling is your own device's free memory. The whole file is read into memory as one array, encrypted in a single call and written back out as one blob rather than streamed in chunks, which makes very large files slower and memory-hungry. The key derivation step costs the same whether the file is two kilobytes or two gigabytes, since it runs once per file rather than per byte.

Related tools