Question 1

How strong is AES-256 in practice?

Accepted Answer

Strong enough that brute-forcing the key isn't the realistic attack — guessing your password is. A 6-character dictionary password will be cracked fast; a 4-word passphrase like 'correct horse battery staple' won't, even with a determined attacker and a GPU farm. The algorithm isn't your weak link, the password is.

Question 2

What if I forget the password?

Accepted Answer

Then the text is gone. There's no backdoor, no reset link, no 'recover via email'. That's the whole point — if the tool could recover it, so could anyone else. Write the password down somewhere physical before you close the tab.

Question 3

Is my text or password sent anywhere?

Accepted Answer

No. Encryption runs in your browser with the Web Crypto API. Open DevTools → Network while you encrypt, and you'll see zero requests. The ciphertext that comes out is the only thing that ever leaves, and only when you copy and paste it.

Question 4

Can I decrypt this on another device?

Accepted Answer

Yes. The ciphertext is self-contained — paste it into this tool on any device, enter the same password, and it decrypts. No account, no sync, no device binding.

Question 5

Is this good enough for real secrets?

Accepted Answer

For 'don't want casual readers to see this' — yes, easily. For 'nation-state adversary is actively targeting me' — use Signal, age, or GPG with a hardware key. This tool is a sensible default for everyday shared secrets, not a witness-protection program.

Text Encrypt / Decrypt

What is Text Encrypt / Decrypt?

Related tools