Password-encrypt a file in this tab — AES-256-GCM as compact JWE, nothing uploaded.
Your files never leave your browser — all processing is local.
Encrypt a file with a password, or decrypt a `.jwe` this page wrote. AES-256-GCM in compact JWE. The password never leaves this tab.
If you lose the password, the file cannot be opened. We cannot recover it. There is no reset, no email, no back door.
Drop a file here
or click to browse — encrypt any file; decrypt a `.jwe` from this tool
A password stays in this tab. The file is encrypted with AES-256-GCM; the content key is wrapped with PBES2-HS256+A256KW (PBKDF2-HMAC-SHA256, 600,000 iterations). The container is compact JWE from RFC 7516 / 7518 — not a homemade box. Decrypt the .jwe on the same page. Nothing is uploaded, and there is no account that could hold a recovery key.
.encA private container is how files get stranded when the site disappears. Compact JWE is an existing open format with published test vectors (RFC 7516 Appendix A.1 for A256GCM, RFC 7517 Appendix C for PBES2 key wrap, RFC 3394 §4.6 for the 256-bit wrap). Other JWE tools that implement the same alg / enc pair can read the file; this page does not invent a header.
There is no reset mail, no security questions, no 'we can unlock it for you'. That is the point of doing this in the browser: we never see the password, so we cannot give it back. Write it down somewhere that will still exist next year before you delete the plaintext.
No. PBKDF2, AES key wrap and AES-GCM all run in this tab via the Web Cryptography API. There is no endpoint that accepts the file.
No. If you lose the password, the file cannot be opened. We cannot recover it. That is not a policy choice we could relax later; the key never existed on a server.
Compact JWE (five base64url segments). Header alg is PBES2-HS256+A256KW, enc is A256GCM. Keep the .jwe extension so you can find it again.
Any implementation of that JWE alg/enc pair can, in principle. This page is not a lock-in. A tool that only speaks age or zip-AES will not open it — those are different formats.
PBKDF2-HMAC-SHA256 at 600,000 iterations, the OWASP 2023 figure for SHA-256. A short wait on encrypt and decrypt is the cost of not storing a fast-to-brute-force key.
Hash the file before you encrypt it, if you need a checksum later.