Plain text is easy to read, and that’s usually the point, until it isn’t. A recovery code, an account note, a private message, a draft you don’t want anyone else to see: for those, you want a lock. This tool locks your text with a password so that only someone who knows the password can read it.
How to use it
To lock text: choose Encrypt, type a password, paste or type your text on the left and press Encrypt. The locked version appears on the right as a block of letters and digits starting with PTXT1.. Copy it and keep it anywhere: in an email, a document, a file, a chat. Without the password it’s unreadable.
To unlock text: choose Decrypt, paste the locked text on the left, enter the same password and press Decrypt. Your original text appears on the right. If the password is wrong, or the text has been changed or cut off, you’ll get an error rather than gibberish.
There’s also a Generate button that makes a random 20-character password using your browser’s secure random generator, and a strength bar that gives you a rough idea of how hard a password is to guess. If you generate one, copy it somewhere safe straight away, because it can’t be shown again later.
What happens under the hood
You don’t need to know this to use the tool, but it’s reassuring to know it isn’t made up.
- A random 16-byte salt is created. The salt means the same password produces a different key every time.
- Your password and the salt are run through PBKDF2 with SHA-256, repeated 250,000 times, to produce a 256-bit key. The repetition makes guessing passwords slow, which is what you want from an attacker’s point of view.
- A random 12-byte initialisation vector is created.
- Your text is encrypted with AES-256 in GCM mode. GCM also adds an authentication tag, so any change to the encrypted text, even a single character, is detected when you try to decrypt it.
- The salt, the vector and the encrypted data are joined together and written out as text, with
PTXT1.at the front so the tool recognises it.
All of this uses the cryptography built into your browser. No code from a third party touches your text, and no network request is made with it.
The honest limits
Strong encryption protects the text. It doesn’t protect everything around it, and it’s worth being clear about where the edges are.
Your password is the weak point. AES-256 is far stronger than any password a person can remember. If you choose “password123” or your pet’s name, an attacker doesn’t need to break AES, they just guess your password. Use a long, random password or a passphrase of several unrelated words, and don’t reuse one from elsewhere.
Forgotten passwords can’t be recovered. There is no reset link and no support team that can open your text, because we never receive your password or your text. That’s the same property that makes the tool private. Keep the password in a password manager.
It can’t protect a compromised device. If your computer or browser has malware, or someone is looking over your shoulder, the text can be read as you type it or after you decrypt it. Encryption protects the stored or sent version, not the moment you read it.
The decrypted text sits on screen. Clear the boxes when you’re done, particularly on shared computers.
It isn’t a substitute for professional tools. For highly sensitive data, such as financial credentials, legal secrets or anything where a leak would be serious, use an established, audited password manager or encryption tool and follow your organisation’s rules. This tool is a convenient, honest way to lock text for everyday privacy.
Saving in your browser
Save in this browser stores the encrypted version, never the plain text, in your browser’s local storage so you can come back to it later with Load saved. Only the locked text is kept. As with the notepad, that storage is local to this browser on this device and can be cleared, so copy or download the encrypted text if it matters.
Everyday uses
- Sharing something sensitive over an ordinary channel. Send the locked text in a normal message and give the password separately, ideally by another route such as a phone call.
- Keeping private notes in a plain file. Store the encrypted block in a text document or a synced folder without exposing the contents.
- Recovery codes and one-off secrets that you want to keep but not leave in plain view.
- Learning how encryption works by trying it and watching how the output changes every time, even with the same input and password.
If you only need to disguise text rather than protect it, such as hiding a spoiler or converting to a transport-friendly format, the encoder and decoder handles Base64, hexadecimal and more. Those are not security, and the tool says so. For non-sensitive jottings, the notepad is simpler.
A good password habit
Longer beats clever. A passphrase of four or five random words is easier to remember than a jumble of symbols and is very strong. A password manager can create and remember unique passwords for you. And never send the password in the same message as the encrypted text.
Making a good password for it
The strength of the lock is the password you choose. The random password generator makes long random ones in your browser, and the random word generator is a starting point for a memorable passphrase, though with a short word list you should use several words and add more than you think you need. Remember that encoding is not encryption: the Base64 tool disguises text without protecting it, so never use it for anything private.