Encrypt file

Some files should only be seen by people who know the password: a contract, an ID scan, a spreadsheet of private numbers. This tool encrypts one or more files with AES-256 in GCM mode and wraps each of them in its own .gxenc file that, without your password, is nothing but random noise.

Your password is turned into a key via PBKDF2 with 250,000 rounds; every file gets a fresh random salt and a fresh initialisation vector, even when you drop several files in one go. GCM mode also appends an authentication tag, so a file that was altered or corrupted afterwards is honestly rejected on decryption instead of producing half-broken garbage.

The crucial point: the entire encryption runs on your browser’s native Web Crypto interface, with no server and no library from a foreign CDN. If you drop several files at once, the one password you enter applies to ALL files in that run - if individual files need a different password, encrypt them in a separate run. Choose a strong, unique password and share it over a different channel than the file. There is no back door: a lost password cannot be recovered by anyone, not even us.

Specifications

In 3 steps

1. Drop one or more files.
2. Set a password (applies to every file dropped in this run).
3. Download the encrypted .gxenc file(s).

Limitations: Protects the content with AES-256-GCM (FIPS 197 / NIST SP 800-38D); the original file name and exact size cannot be read from the .gxenc file, though its approximate length can. With several files in one run, the same password applies to all of them - each file still gets its own random salt (16 bytes) and initialisation vector (12 bytes) plus a 128-bit authentication tag. Decryption only works with the same password and only via the matching "Decrypt file" tool - a forgotten password cannot be recovered by anyone.

FAQ

Related tools

Decrypt file · Protect PDF with a password · Password generator · ROT13 cipher · Encrypt with PGP · Calculate a checksum