Message and file encryption
Lock a message or a file with a passphrase, then send it over any channel: email, a chat app, a cloud folder. Only someone who knows the passphrase can read it. Use it for a one-off secret when you and the other person do not already have a secure way to talk.
Nothing is sent or stored. Your message, file and passphrase are used only inside your own browser, with standard AES-256 encryption built into the browser itself. This page also tells your browser to block every network request, so it could not send anything anywhere even by mistake.
This browser cannot do this here. Encryption needs a modern browser on a secure (https) page. Update your browser, or use a desktop tool from the Resources page.
1. Lock something
The file name is locked along with the contents.
Passphrase strength:
2. Unlock something you received
Finished? Clear the page so nothing stays on screen for the next person who uses this device.
How to use it safely
- Share the passphrase by a different route. If you email the locked message, give the passphrase in person, by phone or in another app. Sending both together undoes the protection.
- Use a long random passphrase. Anyone who gets the locked message can try guesses offline without being noticed. Six random words (the suggest button makes one) is strong; a short or clever one is not. The tool deliberately slows each guess, but it cannot save a weak passphrase.
- Never reuse a passphrase from an account, and do not send it over the same channel as the message.
- Copy carefully. Copy the whole locked message, from the first line to the last. One missing character makes it unreadable.
What this can and cannot do
- It hides the content, not the fact you sent something. Anyone watching sees that an encrypted message was sent, when, to whom, and roughly how big it is.
- It does not prove who sent it. Anyone who knows the passphrase could have made the message. It cannot tell you that it really came from the person you think.
- It is not a chat system. There is no forward secrecy: if the passphrase is ever learned, every message locked with it can be read. For ongoing conversations use an encrypted messenger such as Signal, or PGP for email. See Encryption and Resources.
- It cannot protect a compromised device. If malware or a person is watching your screen or keyboard, they see the message and the passphrase before it is locked. Clipboard history on some devices also keeps what you copy.
- You are trusting this page's code. It runs in your browser from this site. For the highest-risk situations, use a widely reviewed desktop tool such as VeraCrypt, GnuPG or age from the Resources page instead, so you are not relying on any website to serve you the right code.
- If you lose the passphrase, nobody can recover the message. There is no reset and no back door.
- The format is standard. It is AES-256-GCM with a key made from your passphrase using PBKDF2-SHA-256 (600,000 rounds), so other software can open it. Laws in some countries restrict or watch the use of encryption; know the rules where you are.