Password-Based Encryption (PBKDF2 + AES-GCM)

Encrypt and decrypt text with a password using PBKDF2 key derivation and AES-256-GCM. Everything happens in your browser with Web Crypto — the key is derived locally and never leaves your device.

How it works

• Encrypt derives a 256-bit AES key from your password with PBKDF2 (SHA-256), using a random 16-byte salt and the iteration count you choose, then seals the message with AES-256-GCM using a random 12-byte IV.
• The output payload is v1:salt:iv:ciphertext, where each part is base64 — the salt and IV travel with the ciphertext so the recipient needs only the password to decrypt.
• Decrypt parses the payload, re-derives the same key with your password and the same iteration count, and verifies the GCM authentication tag. A wrong password or a corrupted payload fails authentication and reports wrong password or corrupted data.
• AES-GCM authenticates as well as encrypts: any tampering is detected, not silently accepted. Key derivation runs fully locally via crypto.subtle — nothing is uploaded.

About Password-Based Encryption

Password-based encryption converts a human-memorable secret into a strong symmetric key. The iteration count slows down brute-force attacks: 100000 PBKDF2 rounds means each guess costs a measurable amount of CPU, so weak passphrases are much harder to crack than with a single hash round. Higher is stronger but slower — on modern hardware 100000–600000 rounds is a reasonable range for interactive use.

Two warnings: first, the iteration count is deliberately not stored in the payload, so you must remember the same value you used to encrypt. Second, GCM requires a unique IV per encryption — this tool generates a fresh random IV every time, so encrypting the same message twice gives different ciphertexts. Store the full v1: payload; losing the salt or IV makes the data unrecoverable even with the correct password.