About this tool
Credentials, private notes or confidential information should not be sent in plain text by e-mail or messenger. With this tool you encrypt a text with a password. The result is a string that cannot be read without the password – you can send or store it safely.
It uses AES-256 in GCM mode, a modern standard that not only encrypts the text but also protects it against undetected changes. The key is derived from your password with PBKDF2-SHA-256 and 600,000 iterations, which slows down password guessing considerably. Each encryption uses a random salt and initialization vector, so the same text looks different every time.
Encryption and decryption run entirely in your browser via the Web Crypto API. Text and password are neither transmitted nor stored in the link.
How it works
- Choose “Encrypt”, enter your text and a strong password and click “Encrypt”.
- Copy the encrypted text (it starts with “nt1.”) and send it to the recipient.
- Share the password via a different channel, e.g. by phone.
- To read it, the recipient chooses “Decrypt”, pastes the text and enters the password.
Frequently asked questions
How secure is the encryption?
AES-256-GCM is considered secure and is used e.g. in TLS. Security depends crucially on the password, though: a short or common password can be guessed despite PBKDF2. Use a long passphrase – e.g. from the Password Generator.
Can no.tools read my texts?
No. Everything happens in your browser; neither text nor password is sent to a server. Without the password the encrypted text is unreadable for us too – so nobody can recover a forgotten password.
Why does the encrypted text look different every time?
Each encryption generates a random salt and initialization vector, which are stored in the result. This hides whether the same text was encrypted twice.
Isn’t Base64 encryption too?
No, Base64 is only an encoding that anyone can reverse – see Base64 Encode / Decode. Real confidentiality requires encryption with a secret key, as here.