Overview
Introduction
Sharing a sensitive file often means needing to encrypt it first, but installing a dedicated encryption tool for a one-off file is overkill.
This tool encrypts (or decrypts) a real file with password-based AES-256-GCM entirely in your browser, no installation, and nothing uploaded.
What Is AES File Encryptor/Decryptor?
A password-based file encryptor/decryptor using AES-256-GCM, an authenticated encryption mode that detects tampering or corruption, not just a plain cipher.
Your password never becomes the encryption key directly; it's stretched through PBKDF2 (250,000 iterations, SHA-256) with a random per-file salt, which is standard practice for turning a human-memorable password into a cryptographically strong key.
How AES File Encryptor/Decryptor Works
Encrypting generates a random 16-byte salt and 12-byte IV, derives a 256-bit AES key from your password and the salt via PBKDF2, and encrypts the file's raw bytes with AES-GCM using that key and IV, producing ciphertext with a built-in authentication tag.
The output file is the salt, then the IV, then the ciphertext, concatenated, so decryption only needs the output file and the original password. Decrypting re-derives the same key from the embedded salt and password, then AES-GCM's authentication check fails cleanly if the password is wrong or the file was altered.
When To Use AES File Encryptor/Decryptor
Use it to password-protect a sensitive file before sending it somewhere less trusted (a shared drive, an email attachment) than the recipient's inbox.
It's also useful for encrypting a personal backup file you'll store somewhere you don't fully control.
Often used alongside RSA/ECDSA Key Generator and Base64/Hex File Encoder & Decoder.
Features
Advantages
- Uses AES-256-GCM, an authenticated mode: tampering or corruption causes decryption to fail rather than silently returning corrupted plaintext.
- PBKDF2 key derivation with a high iteration count makes brute-forcing a weak password meaningfully slower than using the password as a key directly.
- Self-contained output format (salt + IV + ciphertext in one file) means you only need to keep track of the password, not separate metadata.
Limitations
- Each file is capped at 25 MB, since encryption happens in-memory on the browser's main thread.
- Security depends entirely on your password's strength; PBKDF2 slows down brute-forcing but can't make a weak, guessable password safe.
Examples
Best Practices & Notes
Best Practices
- Use a genuinely strong, unique password for encryption, ideally generated with a password generator rather than memorized and reused.
- Share the encrypted file and the password through different channels (e.g. file via email, password via a phone call or a separate messaging app) so intercepting one doesn't expose the other.
- Keep a backup of the unencrypted original somewhere safe until you've confirmed you can successfully decrypt the output; there's no password recovery if something goes wrong.
Developer Notes
Key derivation uses `crypto.subtle.deriveKey()` with `PBKDF2` (250,000 iterations, SHA-256) producing a 256-bit `AES-GCM` key; encryption uses `crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, data)`, whose output already includes GCM's authentication tag appended to the ciphertext. The output file format is `salt (16 bytes) || iv (12 bytes) || ciphertext+tag`, all generated with `crypto.getRandomValues()`.
AES File Encryptor/Decryptor Use Cases
- Password-protecting a sensitive document before sharing it over a less-trusted channel
- Encrypting a personal file before storing it somewhere you don't fully control
- Learning how password-based AES-GCM encryption with PBKDF2 key derivation actually works end to end
Common Mistakes
- Losing or forgetting the password; there is no recovery mechanism by design.
- Reusing a weak, memorable password; PBKDF2 raises the cost of brute-forcing but doesn't make a weak password strong.
Tips
- Rename the encrypted output with a recognizable extension (like .enc) so you remember it needs this tool's Decrypt mode and the right password to open.