About the Handiwork Text Encrypt & Decrypt
Text Encrypt & Decrypt turns text into an authenticated AES-256-GCM ciphertext using a key derived from your password. Switch to Encrypt to create a portable Base64 block, then use Decrypt with the same password to recover the original. The operation runs locally in your browser. This is a transparent general-purpose utility, not a replacement for an independently audited password manager or secure-messaging system.
How to use the Handiwork Text Encrypt & Decrypt
- Choose Encrypt or Decrypt at the top.
- Enter your text and a password you will remember (or share securely with your recipient).
- Copy the result. To decrypt later, paste the encrypted block and enter the same password.
How the encryption works
New ciphertext uses PBKDF2-HMAC-SHA256 with a random 16-byte salt and 600,000 iterations to derive a 256-bit key. AES-GCM uses a fresh 12-byte IV and adds an authentication tag so a wrong password or modified payload fails closed. The Base64 output contains a format version, salt, IV, and ciphertext. Version 1 payloads created by the earlier 250,000-iteration format remain decryptable.
Choosing a strong password
The security of your encrypted text depends entirely on your password. A short or common password can be brute-forced, so use a long, unpredictable passphrase. There is no password recovery: if you forget it, the text cannot be decrypted by anyone, including us. Store your password somewhere safe, such as a password manager.
Sharing encrypted messages
To send someone an encrypted message, share the Base64 output through any channel — email, chat, or a document — and give them the password through a separate, trusted channel (for example, in person or by phone). They paste the block here, switch to Decrypt, and enter the password to read it. Because decryption is authenticated, they will be warned if the text was altered in transit.
Private by design
Encryption and decryption run in your browser through the Web Crypto API. Handiwork does not submit the text or password to its application server or save them as tool data. The security of any web tool still depends on the page, browser, device, extensions, and how you exchange and store the password.
Assumptions and limitations
- There is no recovery key or password reset. Losing the password makes the ciphertext unrecoverable.
- A weak or reused password can be guessed offline from a copied ciphertext despite a slow key-derivation function.
- This custom envelope format is designed for this tool. Keep a tested copy of the tool or migrate important data to a maintained, audited format for long-term storage.
- Do not rely on a remotely loaded web page as the sole control for high-impact secrets. Use audited end-to-end encrypted software and organizational procedures where the risk warrants it.
Sources and standards
These authoritative references were used to verify the method and guidance on this page.
Frequently asked questions
What encryption does this tool use?
New payloads use AES-256-GCM. The key is derived with PBKDF2-HMAC-SHA256, a random 16-byte salt, and 600,000 iterations through the Web Crypto API. The versioned format can also decrypt older version 1 payloads created with 250,000 iterations.
Is my text or password sent anywhere?
No. Everything is processed locally in your browser. Your text and password are never transmitted, logged, or stored, and nothing persists after you close the page.
What happens if I forget the password?
The text cannot be recovered. Strong encryption has no backdoor, so there is no way to decrypt without the exact password. Keep it somewhere safe, such as a password manager.
Can I share encrypted text with someone else?
Yes. Send them the encrypted Base64 block and share the password through a separate, trusted channel. They paste it here, choose Decrypt, and enter the password to read the message.
Why does decryption say the text was modified?
AES-GCM verifies integrity. If the encrypted block was altered, truncated, or you entered the wrong password, decryption fails and you are warned rather than shown incorrect output.