usefulweb.site Local File Encryption Studio

Cryptography & security tools

Local File Encryption Studio

Encrypt and decrypt files with AES-256-GCM and a password, locally in your browser.

Up to 100 MB. With JavaScript on, the file is processed in your browser and never uploaded.

Use a long passphrase. It cannot be recovered: without it the file is lost.

Raw-key mode. Leave empty when encrypting to generate a random key (shown once).

At least 600,000 (OWASP 2023 recommendation for PBKDF2-HMAC-SHA-256). Decryption reads the value from the file.

Only for reproducible demos. Reusing a salt/IV with the same password breaks AES-GCM security.

Try an example: Encrypt a text file with a password (demo seed) · Decrypt the demo file · Encrypt with a raw AES-256 key

How it works

Encrypts any file up to 100 MB with AES-256-GCM, using a password (PBKDF2-SHA-256, at least 600,000 iterations) or a raw 256-bit key, and decrypts it again. The output is a small documented container. With JavaScript on, everything runs in your browser via WebCrypto and the file never leaves your device.

  • Encryption: AES-256 in GCM mode (authenticated encryption) with a random 96-bit IV. The 16-byte authentication tag detects a wrong key and any modification of the file or its header.
  • Password mode: the key is PBKDF2-HMAC-SHA-256(password in Unicode NFC, UTF-8; random 16-byte salt; ≥ 600,000 iterations; 32 bytes). Raw-key mode uses your 32-byte key directly (or a random one generated for you).
  • Container "UWFE" v1, all integers big-endian: bytes 0–3 "UWFE"; 4 version (1); 5 KDF (1 = PBKDF2-SHA-256, 0 = raw key); 6–9 iterations (0 for raw key); 10 salt length S; then S salt bytes; then IV length (12) and the IV; then ciphertext followed by the 16-byte tag. The whole header is authenticated as GCM additional data.
  • With JavaScript on, the browser does everything with WebCrypto (crypto.subtle: PBKDF2, AES-GCM) and offers the result as a local download; the file and password never leave your device.
  • Without JavaScript or via the API/MCP, the server performs the same steps with Node.js crypto. It then receives the file and the password; the output is kept as a download for about 2 hours and then deleted.

If you forget the password or lose the key, the file cannot be recovered. Keep an unencrypted backup until you have tested decryption.

Sources

For scripts and AI agents

  • JSON API: POST https://fileencryptionstudio.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://fileencryptionstudio.usefulweb.site/mcp · tool name file_encryption_studio
Example request
curl -s -X POST https://fileencryptionstudio.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{"action":"encrypt","file":{"filename":"notes.txt","contentType":"text/plain","contentBase64":"TWVldGluZyBub3RlczogdGhlIHNwYXJlIGtleSBpcyB1bmRlciB0aGUgYmx1ZSBmbG93ZXJwb3QuCg=="},"keyMode":"password","password":"correct horse battery staple","seed":"demo"}'

Related tools

Feedback