Text Encrypt and Decrypt

How to use it

To encrypt

1. Type or paste your message into the box.
2. Choose a passphrase and type it again to confirm. Four or more random words, like “velvet otter planet marmalade”, are strong and easy to remember.
3. Press Encrypt (or Ctrl+Enter). You’ll get a block of letters and numbers.
4. Press Copy or Download .txt and send it however you like: email, chat, a note or a USB stick.
5. Tell the other person the passphrase a different way, for example in person or by phone. Never send it in the same message.

To decrypt

1. Switch to the Decrypt tab and paste the encrypted text, all of it.
2. Enter the passphrase and press Decrypt. The original message appears, confirmed as unchanged.

Use Test decrypt after encrypting to check your passphrase opens the message before you send it.

If you enjoy what we do, consider supporting us. Every little bit means the world! Support Catpool on Ko-fi

How strong is the encryption?

The tool uses AES-256-GCM, the encryption standard used by governments, banks and messaging apps. Your passphrase isn’t used directly. It’s first stretched with PBKDF2-SHA-256 using 600,000 rounds and a random salt, which is the level the security organisation OWASP recommends. That stretching takes your device a fraction of a second, but makes every guess just as slow for an attacker, so trying millions of passphrases becomes impractical.

Each message also gets a fresh random salt and nonce, so encrypting the same text twice with the same passphrase gives completely different output. GCM mode includes a built-in tamper check: if even one character of the encrypted text is changed, decryption fails instead of producing scrambled or altered text.

The weak point of any passphrase encryption is the passphrase. AES-256 can’t be broken, but “password1” can be guessed in seconds. The meter under the box shows whether yours is strong enough. Our Password Generator can make a good one.

What the output contains

The encrypted text is standard base64. Inside it are a version number, the number of PBKDF2 rounds, the 16-byte salt, the 12-byte nonce, then the encrypted message with its 16-byte authentication tag. The version and rounds are protected by the tamper check too. Because the format is documented, anyone can decrypt a message with any standard crypto library (for example Python, Node.js or OpenSSL) as long as they have the passphrase. You’re never locked in to Catpool.

Privacy

Encryption and decryption happen entirely in your browser, using its built-in Web Crypto. Your message and passphrase are never uploaded, logged or stored, and Catpool can’t see them. That also means we can’t recover a forgotten passphrase. Nobody can. The passphrase boxes are cleared when you leave the page, and the tool doesn’t save anything in your browser.

Good uses and limits

• Sending a Wi-Fi password, door code or account details to a family member.
• Keeping private notes in a cloud document or email draft.
• Storing recovery codes or a secret in a file that might be seen by others.

It isn’t a replacement for an end-to-end encrypted messenger such as Signal or WhatsApp for everyday chat, or for a password manager for storing logins. And encryption can’t protect a message on a device that already has malware, since that could read what you type.

Frequently asked questions

It says the passphrase is wrong, but I’m sure it’s right. Why?

Passphrases are case-sensitive, and extra or missing spaces count. The other common cause is that part of the encrypted text was lost when copying: make sure you paste everything, from the first character to the last. Line breaks are fine.

Can I decrypt messages made by other tools?

Only messages made with this tool, or with code following the same documented format. Other sites use different formats and settings.

Is the encrypted text safe to post publicly?

With a strong passphrase, yes: without it the text is meaningless. With a weak one, someone could guess it, so make it long.

Does it work offline?

Yes. Once the page has loaded you can disconnect from the internet and it still works, because nothing needs our server.

Related: Catpool home, Security, Password Generator, Has My Password Been Leaked?, File Hash Checker, Two-Factor Code Generator.