There is no upload endpoint — your files are processed in this browser tab. Open your network tab and check. See how it stays private.
How to encrypt a file
- Add a file. Drop the file you want to protect (or an .enc file to decrypt).
- Enter a passphrase. Choose a strong passphrase — it derives the encryption key.
- Encrypt. The file is sealed with AES-256-GCM into a portable .enc container.
- Save & share. Download the .enc file; the recipient decrypts it here with the passphrase.
Sending a sensitive file through email or chat means trusting every hop in between. Encrypting it first turns it into an opaque blob that's useless without the passphrase, so the channel no longer has to be trusted — only the passphrase does, shared out of band.
The strength here is the key derivation: Argon2id is deliberately slow and memory-hungry, which blunts brute-force attempts on the passphrase, and AES-256-GCM both encrypts and detects tampering. The output .enc file bundles the salt and IV so it's self-contained.
Pick a passphrase that scores well in the Password strength checker, and for splitting the passphrase itself among several people, use Shamir secret sharing.
Frequently asked questions
How does the encryption work?
Your passphrase is stretched with Argon2id (memory-hard, brute-force resistant) into a 256-bit key, which AES-GCM uses to encrypt and authenticate the file. The salt and IV travel in the .enc header.
What happens if I forget the passphrase?
There's no recovery. The key exists only as something derived from your passphrase, so a lost passphrase means the data is unrecoverable by design.
Can the recipient decrypt without special software?
Yes — they open this same tool in any modern browser, load the .enc file, and enter the passphrase. No install and no account.
Does my file get uploaded to be encrypted?
No. Key derivation and AES run in this browser tab via WebCrypto and WASM; the file is processed locally and buffers are cleared after export.