Can someone decrypt it without the password?

Only by guessing the password. The string holds no copy of the key, and anyone who has it can try passwords offline with any software; each guess costs 600,000 PBKDF2 iterations, which slows guessing down but cannot protect a short or common password. Use a long random password and send it separately from the string.

Why does decryption fail?

The password is wrong or the string was changed. AES-GCM checks a 16-byte tag, so one changed character gives "Decryption failed: the password is wrong or the encrypted string was changed." A string without its v1: prefix is read as the page's old format, and the message says so.

How long is the encrypted string?

3 + 4 × ceil((44 + n) ÷ 3) characters for a text of n UTF-8 bytes: hello gives 71 characters, 100 bytes give 195 and 1,000 bytes give 1,395. An accented letter takes 2 bytes, so café is 5 bytes.

Why is the result different each time I encrypt the same text?

Each encryption draws a new random salt and IV, so the key and the ciphertext change every time. Every version decrypts to the same text with the same password.

Can another program decrypt the v1: string?

Yes, if it repeats the steps: Base64-decode what follows v1:, take the first 16 bytes as the salt and the next 12 as the IV, derive a 256-bit key with PBKDF2-HMAC-SHA256 and 600,000 iterations using the Base64 text of the salt as the PBKDF2 salt, then decrypt the rest with AES-GCM and no additional data. The layout is this page's own, not a standard file format.

What does Legacy Format Detected mean?

The string came from the page's earlier version: Base64 of IV, ciphertext and tag with no prefix, keyed with the fixed salt text "fixed-salt" and 100,000 iterations. Every such string shares that salt, so encrypt the text again to get a v1: string.

AES Encryption

Encrypt and decrypt text with a password using AES-256-GCM, the key derived by PBKDF2-SHA256 at 600,000 iterations. Strength depends on the password. How it works

Plaintext

Password

The password is the only secret: anyone who can guess it can read the text. A long, random password is much safer than a short or common one.

Result

Format: v1: followed by Base64 of salt (16 bytes), IV (12 bytes) and the AES-256-GCM ciphertext with its 16-byte tag. The key is PBKDF2-HMAC-SHA256 with 600,000 iterations, using the Base64 text of the salt as the PBKDF2 salt. This is this page's own layout, so other tools cannot decrypt it without the same steps.

About the AES Encryption

Text encrypted on this page uses AES-256-GCM with a key derived from your password by PBKDF2-HMAC-SHA256 at 600,000 iterations, and comes out as v1: followed by the Base64 of a 16-byte salt, a 12-byte IV, the ciphertext and a 16-byte tag. A 5-letter text such as hello becomes a 71-character string, and the same password on this page turns it back into the text.

Layout of a v1: string

Part	Length	What it is
Prefix	3 characters	v1:, written before the Base64
Salt	16 bytes	Random; its Base64 text is the PBKDF2 salt
IV	12 bytes	Random 96-bit nonce for GCM
Ciphertext	As many bytes as the text in UTF-8	The AES-256-GCM output
Tag	16 bytes	GCM authentication tag, checked when decrypting

Salt, IV, ciphertext and tag are joined in that order and Base64-encoded with padding. The key is PBKDF2-HMAC-SHA256, 600,000 iterations, 256 bits, and no additional authenticated data is used.

Length of the encrypted string

Text (UTF-8 bytes)	v1: string (characters)
1	63
5	71
16	83
100	195
1,000	1,395
10,000	13,395
749,953 (the limit)	999,999

Characters = 3 + 4 × ceil((44 + bytes) ÷ 3). An English letter is 1 byte, an accented letter 2, and an emoji such as 😀 4.

Messages when decrypting

You paste	Message
v1:abc$ (the part after v1: is not Base64)	The text after "v1:" is not valid Base64. Paste the whole encrypted string without changes.
hello (no v1: and not Base64)	This is not a "v1:" string and not valid Base64, so it cannot be decrypted.
A v1: string with the wrong password or one changed character	Decryption failed: the password is wrong or the encrypted string was changed.

Frequently asked questions

Can someone decrypt it without the password?: Only by guessing the password. The string holds no copy of the key, and anyone who has it can try passwords offline with any software; each guess costs 600,000 PBKDF2 iterations, which slows guessing down but cannot protect a short or common password. Use a long random password and send it separately from the string.
Why does decryption fail?: The password is wrong or the string was changed. AES-GCM checks a 16-byte tag, so one changed character gives "Decryption failed: the password is wrong or the encrypted string was changed." A string without its v1: prefix is read as the page's old format, and the message says so.
How long is the encrypted string?: 3 + 4 × ceil((44 + n) ÷ 3) characters for a text of n UTF-8 bytes: hello gives 71 characters, 100 bytes give 195 and 1,000 bytes give 1,395. An accented letter takes 2 bytes, so café is 5 bytes.
Why is the result different each time I encrypt the same text?: Each encryption draws a new random salt and IV, so the key and the ciphertext change every time. Every version decrypts to the same text with the same password.
Can another program decrypt the v1: string?: Yes, if it repeats the steps: Base64-decode what follows v1:, take the first 16 bytes as the salt and the next 12 as the IV, derive a 256-bit key with PBKDF2-HMAC-SHA256 and 600,000 iterations using the Base64 text of the salt as the PBKDF2 salt, then decrypt the rest with AES-GCM and no additional data. The layout is this page's own, not a standard file format.
What does Legacy Format Detected mean?: The string came from the page's earlier version: Base64 of IV, ciphertext and tag with no prefix, keyed with the fixed salt text "fixed-salt" and 100,000 iterations. Every such string shares that salt, so encrypt the text again to get a v1: string.

Sending a protected note

Encrypt a note before you send it or store it somewhere you do not fully trust, then give the password to the reader by a different route, such as a phone call. The reader opens this page, chooses Decrypt, pastes the whole v1: string and enters the same password. A string pasted with a character missing or changed fails the tag check and shows an error, so copy it whole, including the v1: prefix.

The v1: format

Encrypt draws 16 random salt bytes and a 12-byte random IV, derives a 256-bit key with PBKDF2-HMAC-SHA256 and 600,000 iterations (the PBKDF2 salt is the 24-character Base64 text of the 16 salt bytes), and encrypts the UTF-8 text with AES-256-GCM, which adds a 16-byte authentication tag. The output is v1: followed by the Base64 of salt || IV || ciphertext || tag, so a text of n bytes gives 3 + 4 × ceil((44 + n) / 3) characters: hello (5 bytes) gives 71. Because GCM checks the tag, a wrong password or one changed character makes decryption fail with a message instead of returning scrambled text. Decrypt also reads the page's older format (Base64 of IV, ciphertext and tag with no prefix, keyed with a fixed salt and 100,000 iterations) and suggests re-encrypting it. Encrypt takes up to 749,953 bytes of UTF-8, so every string it writes fits the 1,000,000 characters Decrypt accepts.

Fun Fact: NIST published the Advanced Encryption Standard, FIPS 197, on November 26, 2001, naming the Rijndael block cipher as the winner of its AES competition. An updated edition of FIPS 197 followed on May 9, 2023.

Related Tools

View all tools

Dev

Password Generator

Generate a random password of 8 to 128 characters from uppercase, lowercase, numbers and symbols, and see its entropy in bits. Can skip look-alike characters.

Dev

Hash Generator

Compute the MD5, SHA-1, SHA-256, SHA-384 or SHA-512 hash of text or a file and compare it with an expected checksum. The file is hashed in your browser.

Dev

HMAC Generator

Compute an HMAC with SHA-1, SHA-256, SHA-384 or SHA-512 and check it against a signature, with webhook presets for GitHub, Stripe, Shopify and Slack.

Dev

PBKDF2 Calculator

Derive a PBKDF2 key in hex or Base64 from a password and salt with HMAC-SHA-1, SHA-256, SHA-384 or SHA-512, and check it against a key you paste.

Dev

Text Encryptor and Decryptor

Encrypt or decrypt text with a password using AES-256-GCM and a PBKDF2-SHA-256 key of 600,000 iterations. The password cannot be recovered if lost.

Dev

Password Entropy Calculator

Estimate password entropy as length × log₂(pool size) and average crack times at three guess rates. Common passwords and patterns are rated Very Weak.