Message Encryption
Encrypt a message with a password (AES-256).
- Free
- No sign-up
- Private: runs in your browser
Encrypt a message with a password
Sometimes you need to send a Wi-Fi password, an API key, bank details or a private note through a channel you do not fully trust, such as email or a chat app that keeps history forever. This tool turns your message into encrypted text that only someone with the password can read. It runs entirely in your browser, so the plain message and the password never leave your device.
How to use it
- Type the message and choose a strong password (or let the tool suggest one).
- Press Encrypt and copy either the encrypted text or the share link.
- Send the link through one channel and the password through another, for example email and a phone call.
- The recipient opens the link, enters the password and reads the message. A wrong password is refused.
What happens under the hood
Your password is stretched into a 256-bit key with PBKDF2-SHA256 using 310,000 iterations and a fresh random salt, which makes every password guess expensive for an attacker. The message is then encrypted with AES-256 in GCM mode using a fresh random nonce. GCM adds an authentication tag, so the encrypted text cannot be altered without detection. The salt, nonce and ciphertext are packed into one short token that starts with CNX1.
Why the link is safe to share
The encrypted token travels after the # sign in the link. Browsers keep that part of the address on the device and never include it in requests to a web server, so Corenexis never receives it, even when the page is opened. Nothing is stored in a database either: the token itself is the message. That also means there is no way to delete a link once sent, so treat the link like the message and keep the password separate. For the strongest protection, use a passphrase of five or more random words.
Frequently asked questions
How secure is this encryption?
Messages are encrypted with AES-256-GCM, the same cipher used by banks, messaging apps and HTTPS. The key is derived from your password with PBKDF2-SHA256 and 310,000 iterations plus a random salt, which makes guessing passwords slow. GCM also detects any change to the encrypted text.
Is my message or password sent to your server?
No. Encryption and decryption happen in your browser with the Web Crypto API. The share link keeps the encrypted text after the # sign, a part of the address that browsers never send to any server, and nothing is stored anywhere.
What happens if I forget the password?
The message cannot be recovered. There is no reset or backdoor: without the exact password, the encrypted text is useless to everyone, including Corenexis.
How should I share the password?
Never in the same message or channel as the link. Send the link by email and tell the password by phone, or the other way round. A long passphrase of several random words is both strong and easy to say.
Why does decryption say the password is wrong?
Either the password is not exactly the same (it is case-sensitive), or the encrypted text was cut off or changed when it was copied. AES-GCM refuses to decrypt anything that does not match, so you never get garbled output.