Security / Files
Encrypt a File with a Password (AES-256)
Encrypt any file with a password in your browser, using AES-256-GCM, and decrypt it again here; nothing is uploaded, and files up to 1 GB work.
Encrypt a File with a Password (AES-256): Your password is stretched into a 256-bit key with 600,000 rounds of PBKDF2-HMAC-SHA-256 and a random salt. The file is encrypted in 4 MB chunks with AES-256-GCM, each with its own nonce and an authentication tag, and the chunks are bound to the file and to their order, so any change, reordering, or cut makes decryption fail. The original name and type are encrypted along with the content. Runs 100% locally in your browser with zero server file uploads.
- Category
- Developer tools
- Runs
- In your browser
- Cost
- Free · no sign-up
- Availability
- Ready to use
Runs entirely in your browser
Nothing is uploaded
The file is encrypted in your browser with AES-256-GCM, using a key made from your password with 600,000 rounds of PBKDF2, and saved as a .toea file; nothing is uploaded. Open it again here with the same password. There is no way to recover a forgotten password, so keep it somewhere safe. Any change to the encrypted file, or cutting it short, makes decryption fail rather than give a damaged file.
The file format
A .toea file starts with the 8 bytes TOEAFILE, a version byte, the PBKDF2 iteration count and chunk size as 4-byte big-endian numbers, the 16-byte salt, and an 8-byte nonce prefix. Then come the chunks, each as a 4-byte length and the AES-GCM output; the first holds the original name and type as JSON. A chunk's nonce is the prefix followed by the chunk number, and its additional data is the header plus one byte that is 1 for the last chunk.
For text rather than files, use encrypt text; to check that a file arrived unchanged without encrypting it, the file hash tool.
Choosing a password
The encryption is only as strong as the password. Several random words, or 12 or more random characters, are far beyond practical guessing even for a stolen file; a short word or a name is not.
The password generator makes one, and a password manager keeps it safe. Share the password through a different channel from the file.
How to use it
- Choose a file to encrypt, or a .toea file to decrypt.
- Enter a password, twice when encrypting.
- Download the encrypted .toea file, or the original file with its name.
Privacy & limitations
The file never leaves your device: encryption and decryption run in your browser.
Related tools
Frequently asked questions
What if I forget the password?
The file cannot be recovered: there is no back door, and guessing a long password is impractical. Keep it in a password manager.
Can other programs open a .toea file?
No: open it here, with the same password. The format is documented on this page, so it can be decrypted with standard tools if this site ever went away.
How big a file can I encrypt?
Up to 1 GB, depending on the memory in your device; for larger files, use a desktop tool such as 7-Zip with AES-256.
Free tool · runs in your browser · no account required