Skip to content
OneTooling

Encrypt & Decrypt Files

Encrypt or decrypt files and text with a password using AES-256-GCM. Runs in your browser, so the file and password are never uploaded.

Runs in your browser · nothing uploaded
What do you want to do?
What are you working with?

Drop a file here, or

Any file type and size

Write the password down somewhere safe. It cannot be recovered or reset. If you lose it, the encrypted data is gone for good, and nobody, including us, can open it.

Why is there an ad? This tool is free and runs on your device. One small ad pays for hosting and new tools. No pop-ups, no autoplay, never inside the tool. How we make money

How to encrypt or decrypt a file

  1. Choose Encrypt or Decrypt, then pick a file or switch to Text and paste your message.
  2. Type a password (twice when encrypting). Use a long phrase you do not use anywhere else.
  3. Press the button. Encrypted files are saved as name.ext.enc; decrypting removes the .enc again.

A lost password cannot be recovered. A wrong password is reported clearly, and so is a file that was changed or cut short, because every piece is authenticated.

The file format (OTE1)

Everything is big-endian. The header is 38 bytes and is followed by the encrypted chunks.

  • Bytes 0-3: the magic text OTE1
  • Byte 4: format version (1). Byte 5: key derivation, 1 = PBKDF2-HMAC-SHA-256
  • Bytes 6-9: PBKDF2 iteration count
  • Bytes 10-25: random 16-byte salt. Bytes 26-33: random 8-byte nonce prefix
  • Bytes 34-37: plain chunk size (1,048,576)
  • Then the chunks: AES-256-GCM output, each plain chunk plus a 16-byte tag. The IV of chunk i is the nonce prefix followed by i as 32 bits. The authenticated data is the whole header plus one byte that is 1 on the last chunk, so removed, reordered, or truncated chunks fail to decrypt.

The text option writes the same bytes as Base64.

Questions

Is my file or password uploaded?

No. Encryption and decryption run in your browser with the Web Crypto API. The file, the text, and the password never leave your device.

What if I forget the password?

The data is lost. The password is the only key, it is never stored anywhere, and there is no reset or back door. Save it in a password manager before you delete the original.

How strong is the encryption?

Files are encrypted with AES-256-GCM. The key comes from your password through PBKDF2-SHA-256 with at least 600,000 iterations and a random salt. A long, unique password matters more than any setting: a short one can still be guessed.

Can I decrypt the file with another program?

Yes, in principle. The format is documented below and uses only standard primitives, so anyone can write a decryptor. Common tools such as 7-Zip, GPG, or OpenSSL will not open it directly, because they expect their own formats.

How large a file can I encrypt?

The file is processed in 1 MB pieces, so memory use stays low. Where the browser can write straight to disk (Chrome and Edge), files over 200 MB are saved as they are encrypted. Elsewhere the result is held until it is saved, which limits you to your free memory.

Credits

Built by OneTooling using standard browser features. No third-party code runs on your data.

More tools

Password GeneratorHash GeneratorBcrypt Generator & CheckerPassword Strength CheckerQR Code Generator