BYTETOOLS

File Encryption Tool

Encrypt and decrypt any file locally with AES-256-GCM and a PBKDF2-derived passphrase key. Nothing is uploaded and no account is needed.

Drop any file to encrypt, or a .btenc file to decryptEncrypted in this tab with AES-256-GCM — the file is never uploaded

Nothing is stored and nothing is sent anywhere. If you forget the passphrase the file is gone for good — there is no reset, no recovery and no back door.

What is the File Encryption Tool?

This tool encrypts a file in your browser by deriving a 256-bit key from your passphrase with PBKDF2-HMAC-SHA-256, then encrypting the file with AES-256-GCM under a fresh random salt and initialisation vector.

  • AES-256-GCM authenticated encryption via the Web Crypto API
  • PBKDF2-HMAC-SHA-256 key derivation with a configurable iteration count
  • Fresh 16-byte random salt and 12-byte IV for every file
  • Self-describing container so decryption needs only the passphrase
  • Tampering and wrong passphrases detected by the GCM authentication tag
  • Works offline — the file and passphrase never leave your device

How to use the File Encryption Tool

  1. 1

    Drop the file you want to encrypt, or a previously encrypted .btenc file to decrypt.

  2. 2

    Type your passphrase, and repeat it in the confirmation box when encrypting.

  3. 3

    Adjust the PBKDF2 iteration count if you want a slower, more attack-resistant derivation.

  4. 4

    Click Encrypt file, or Decrypt .btenc file if you dropped an encrypted container.

  5. 5

    Download the result and store your passphrase somewhere you will not lose it.

About the File Encryption Tool

Drop a file, type a passphrase, and get back an encrypted container you can email, back up or store anywhere. The key is derived from your passphrase using PBKDF2-HMAC-SHA-256 with a configurable iteration count and a 16-byte random salt, then used to encrypt the file with AES-256-GCM under a fresh 12-byte initialisation vector.

The output is a self-describing container: a short header holds the format version, the iteration count, the salt and the IV, followed by the ciphertext and its authentication tag. Drop that file back into this tool with the same passphrase and it decrypts. Because GCM is authenticated, a wrong passphrase or a single altered byte is detected and rejected rather than producing garbage.

Everything happens in your browser using the Web Crypto API. The file and the passphrase are never uploaded, never logged and never stored — which also means there is no recovery. If you forget the passphrase, the file is gone permanently, and no one, including us, can help.

Frequently asked questions

How do I password-protect a file without installing software?

Drop it above, enter a passphrase and click Encrypt file. The encryption runs in your browser with AES-256-GCM and you download the result. No account, no upload and no installation — but keep the passphrase safe, because it is the only way back in.

What happens if I forget the passphrase?

The file is unrecoverable. There is no reset link and no back door: the key exists only while you are typing the passphrase, and nothing about it is stored anywhere. Write it down or put it in a password manager before you encrypt anything important.

Is AES-256-GCM secure enough for sensitive files?

The cipher is excellent and is what TLS uses. The weak link is almost always the passphrase, since an attacker with your file can guess offline. A long random passphrase from a password manager, plus a high iteration count, is what makes the difference.

Can I decrypt these files with another tool?

Not directly, because the container format is specific to this tool. The pieces are all standard — PBKDF2-HMAC-SHA-256, AES-256-GCM, a 16-byte salt and 12-byte IV — so it is reproducible in any language, but you would need to parse the header yourself.

How many PBKDF2 iterations should I use?

OWASP suggests at least 600,000 for PBKDF2-HMAC-SHA-256 in password storage. Higher is slower for an attacker and for you, which is the point. If you find it sluggish on an old phone, lengthen the passphrase instead of lowering the count.

Related tools