Text is encrypted in your browser with AES-256-GCM; in password mode the key comes from your password through Argon2id with 64 MiB of memory and 3 passes, which makes each password guess slow and costly. A note link puts the encrypted text after the # in the address, a part browsers do not send to the server, and nothing is stored on this site.
What this is for
Sometimes you need to pass a short piece of text through a channel you do not fully trust: a Wi-Fi password in a group chat, a door code in an email, recovery codes you want to keep in a notes app, account details for a relative. Encrypting the text first means the channel only ever carries scrambled characters. Only someone with the password, or with the complete link in random-key mode, can turn it back into the original.
It is a tool for small, one-off notes. It is not a messaging app, a password manager or a file vault.
Two ways to lock a note
| Question | With a password (default) | With the link alone |
|---|---|---|
| What you share | The encrypted text or link, plus the password through another channel | Just the link |
| Who can read it | Anyone with both the encrypted text and the password | Anyone who has the complete link |
| Key | Derived from your password with Argon2id | A random 256-bit key generated in your browser, placed in the link |
| Typical use | Notes you keep, or send in two parts | A quick private note to one person over a channel you trust enough |
In password mode, the safety of the note depends on the password. Argon2id makes every guess expensive, but a short or common password can still be found by someone who tries the likely ones. A passphrase of five or six random words is a good fit; the passphrase generator makes one.
In random-key mode, the link is the key. Treat it like the note itself.
Encrypt and decrypt a note
- Type or paste the text into the top box.
- Under How the reader opens it, choose With a password or With the link alone. For a password, type it; tick Show password if you want to check it.
- Press Encrypt. The encrypted text appears in the lower box, and the note link appears below it, each with a copy button.
- Share the link or the encrypted text. For a password note, send the password separately, for example by phone or in a different app.
- To read a note, open its link (the page fills itself in), or paste the link or the encrypted text into the lower box, type the password if one is needed, and press Decrypt.
A note made with a random key opens as soon as its link is loaded. A note made with a password waits for the password.
What happens to the text
- Key. In password mode, the page creates 16 random bytes of salt and runs Argon2id over your password and the salt, using 64 MiB of memory, 3 passes and 1 lane, to make a 256-bit key. In random-key mode, it creates 32 random bytes instead. Random bytes come from the browser's cryptographic random number generator.
- Encryption. The text is encrypted with AES-256 in GCM mode with a fresh random 12-byte nonce. GCM also adds a 16-byte authentication tag, so any change to the encrypted text makes decryption fail instead of producing garbage.
- Format. The result is written as
v1.p.(password) orv1.k.(random key) followed by base64url data. The version and mode are part of what the tag protects, so they cannot be swapped without detection. A random-key note ends with a second section that holds the key. - Link. The link is this page's address, then
#, then that text.
Decrypting reverses the steps. A wrong password, a link with a piece missing or a single edited character makes decryption stop with a message saying what went wrong; the page never shows half-decrypted text.
Why the part after # stays in your browser
The internet standard for web addresses (RFC 3986) treats the part after # as a fragment that the browser uses after the page loads. Browsers do not include it in the request to the server, so this site's host receives a request for /encrypt-text/ and nothing more. The page's own code reads the fragment and decrypts it locally.
That protects the note from this site, not from everywhere else the link goes. Be aware that:
- the app you paste the link into (chat, email, a notes service) has the whole link, fragment included, and may keep it or show it in previews;
- the link lands in your browser history and, if you use browser sync, in your synced history;
- anyone who sees the screen or a screenshot of a random-key link can read the note.
For anything sensitive, use password mode and send the password another way.
Limits worth knowing
- No recovery. There is no account and no copy on a server. A lost password means a lost note.
- No expiry and no "read once". Nothing is stored, so nothing can be deleted after reading. The link works for as long as someone has it.
- Length. Long notes make long links. When a link grows past a size that some apps may cut off, the page shows its length; for long text, share the encrypted text instead of the link.
- Speed. Argon2id with 64 MiB takes a moment on purpose. On an old phone, encrypting or decrypting in password mode can take a few seconds.
- The device matters. If the computer or phone you type on is compromised, encryption on the page cannot help.
Nothing is stored or sent
Encryption and decryption run in this tab. The text, the password, the key and the result are not sent to this site or anywhere else, and the site has no database to keep them in. The password-to-key step runs in a background worker inside your browser. When you close the tab, the page forgets everything you typed.
Technical note
AES-GCM comes from the browser's built-in Web Crypto API. Argon2id comes from the hash-wasm library, compiled to WebAssembly and served from this site. The parameters are fixed in format v1 so a note made today decrypts the same way on any device that loads the page. Argon2id at 64 MiB and 3 passes matches the memory and pass count of the second recommended setting in RFC 9106 (which uses 4 lanes), and is well above the OWASP minimum of 19 MiB and 2 passes. To see which requests the page makes while you encrypt (none that carry your text), see the methodology page.
FAQ
Can the website read my encrypted notes?
No. The text is encrypted in your browser, and in a note link the encrypted part sits after the #, which browsers do not send to the server. The site stores nothing.
What if I forget the password?
The note cannot be recovered. There is no reset, because no copy and no key exist anywhere except with you.
Is a random-key link safe to post in a group chat?
Only if you are fine with everyone in the chat, and the chat service, being able to read it. The link contains the key. Use password mode for anything you would not post openly.
What encryption does it use?
AES-256 in GCM mode. In password mode, the key is derived with Argon2id using 64 MiB of memory, 3 passes, 1 lane and a 16-byte random salt.
Why does decryption fail with the right password?
Most often the encrypted text or the link was cut short or altered when it was copied. GCM rejects any changed character. Copy the whole value again.
Does the note expire?
No. Nothing is stored, so there is nothing to expire. Anyone who keeps the link (and the password, if one was used) can open it later.
Sources
Checked 2026-10-11.
- NIST SP 800-38D: the Galois/Counter Mode used for encryption and authentication.
- RFC 9106, Argon2: the recommended Argon2id settings, including 64 MiB with 3 passes.
- OWASP Password Storage Cheat Sheet: minimum Argon2id settings of 19 MiB and 2 iterations.
- RFC 3986, section 3.5: the fragment is resolved by the browser after retrieval.
Last updated: