Text Encryption & Decryption (AES-256-GCM with a password)

No. Encryption and decryption run on this device with the browser’s built-in Web Crypto API. Text, passwords and encrypted output are never sent, stored or logged, and everything is gone when you close the page.

No. There is no password recovery and no back door. For anything important, store the password somewhere safe (such as a password manager) before encrypting.

It uses AES-256-GCM authenticated encryption. The key is derived from the password and a random 16-byte salt with PBKDF2-HMAC-SHA-256 at 600,000 iterations (the OWASP recommendation), and every encryption uses a fresh random nonce. Security still depends on the password: short or common passwords can be guessed by anyone who has the encrypted text.

Either the password differs (case, spaces and similar-looking characters count) or the encrypted text was changed or cut off. AES-GCM authentication detects even a one-character change, and then no content is shown at all.

"YT1.header.salt.nonce.ciphertext", each part base64url without padding. The header is 6 bytes: cipher id 1 = AES-256-GCM, KDF id 1 = PBKDF2-HMAC-SHA-256, iteration count as a 32-bit big-endian number. The salt is 16 bytes, the nonce 12 bytes, and the ciphertext ends with the 16-byte tag. Everything before the last "." is the additional authenticated data; the password is NFC-normalized UTF-8 and the text is UTF-8.

Not directly, because the envelope format is specific to this tool. It only uses standard algorithms, though, so it can be decrypted elsewhere by implementing the description above.