How to Encrypt & Decrypt Text Online: Security Guide
How to Encrypt & Decrypt Text Online: Security Guide
Encryption is one of the most powerful tools available for protecting information, and it is more accessible than ever. Yet misconceptions about what encryption is, how it works, and what it actually protects you from are extremely common — even among technically experienced people. This guide cuts through the confusion with honest, accurate explanations of the core concepts: symmetric and asymmetric encryption, what AES does and does not do, why Base64 is absolutely not encryption, how hashing differs from encryption, and why the strength of your key or password matters more than almost anything else.
You can put these concepts into practice immediately using the Encryptor / Decryptor tool, which runs entirely in your browser — your text never leaves your device.
What Encryption Actually Does
Encryption is a process that transforms readable data — called plaintext — into an unreadable scrambled form called ciphertext, using a mathematical algorithm and a secret value called a key. Decryption is the reverse: given the ciphertext and the correct key, the original plaintext can be recovered.
The fundamental guarantee of a well-implemented encryption system is that without the key, recovering the plaintext is computationally infeasible. It is not theoretically impossible — it is just that an attacker trying all possible keys would need more time than the universe has existed, even with every computer on Earth working in parallel.
Encryption protects confidentiality. It does not, by itself, protect integrity (whether the data has been tampered with), authenticity (whether the message is actually from who it claims to be from), or availability (whether you can access the data at all). Those properties require additional tools: message authentication codes (MACs), digital signatures, and redundant storage respectively.
Being clear about what encryption does and does not protect against is not pessimism — it is the only way to use it effectively.
Symmetric vs. Asymmetric Encryption
There are two fundamentally different models of encryption, and confusing them leads to serious mistakes.
Symmetric Encryption
In symmetric encryption, the same key is used to both encrypt and decrypt the data. Both the sender and the recipient must possess this key. The key must be kept secret from everyone else.
Symmetric encryption is fast and efficient, making it suitable for encrypting large amounts of data. The algorithms commonly used today — AES being the most prominent — can encrypt gigabytes per second on modern hardware.
The main challenge of symmetric encryption is key distribution: how do two parties securely share a secret key when they have no existing secure channel? This is sometimes called the "key exchange problem." If you email someone a symmetric key so they can decrypt a file, and your email is intercepted, the encryption offers no protection.
Asymmetric Encryption
Asymmetric encryption — also called public-key cryptography — uses two mathematically related but distinct keys: a public key and a private key. Anything encrypted with the public key can only be decrypted with the corresponding private key, and vice versa.
The public key can be shared freely with anyone. The private key must be kept strictly secret by its owner. This solves the key distribution problem elegantly: you publish your public key, and anyone can use it to encrypt a message that only you can read.
The tradeoff is performance. Asymmetric algorithms like RSA and elliptic-curve cryptography are orders of magnitude slower than symmetric algorithms. In practice, most secure systems — including TLS (the "S" in HTTPS) — use asymmetric cryptography only to securely exchange a symmetric key, then use the symmetric key for the actual data encryption.
Which Should You Use?
For most personal use cases — encrypting a sensitive note, protecting a file before uploading it to cloud storage, or sharing confidential text with someone — symmetric encryption with a strong password is appropriate. The Encryptor / Decryptor uses AES symmetric encryption, which is the right choice for this kind of task.
What Is AES?
The Advanced Encryption Standard (AES) is the symmetric encryption algorithm adopted as a U.S. federal standard in 2001 after an open international competition organized by NIST (National Institute of Standards and Technology). It replaced the older DES (Data Encryption Standard), which had become vulnerable to brute-force attacks due to its small key size.
AES is a block cipher: it operates on fixed-size blocks of data (128 bits, or 16 bytes) and transforms each block using a series of mathematical operations that mix and substitute bits in ways that depend on the key. The same algorithm is applied repeatedly in "rounds" — 10 rounds for AES-128, 12 for AES-192, and 14 for AES-256.
Key Sizes
AES supports three key sizes:
- AES-128: 128-bit key (16 bytes)
- AES-192: 192-bit key (24 bytes)
- AES-256: 256-bit key (32 bytes)
All three are considered secure against known attacks. AES-256 has a larger margin of safety and is preferred in high-security contexts. None of these variants have been practically broken — the algorithm itself has withstood more than two decades of intense public cryptanalysis.
Modes of Operation
Because AES is a block cipher, you need a "mode of operation" to encrypt data longer than 16 bytes. The mode determines how successive blocks are combined. Common modes include:
- ECB (Electronic Codebook): Each block is encrypted independently. This is insecure because identical plaintext blocks produce identical ciphertext blocks, revealing patterns in the data. Never use ECB for real data.
- CBC (Cipher Block Chaining): Each block is XORed with the previous ciphertext block before encryption. More secure than ECB but requires a random initialization vector (IV) and is not parallelizable.
- GCM (Galois/Counter Mode): A modern mode that combines encryption with authentication, providing both confidentiality and integrity verification. It is the recommended mode for new applications.
When using AES, the mode matters enormously. AES-256 in ECB mode is far less secure than AES-128 in GCM mode. The algorithm name alone is not sufficient information.
Base64 Is NOT Encryption — This Is Critical
This distinction is so important that it deserves its own section, stated as plainly as possible:
Base64 is an encoding scheme, not an encryption algorithm. It provides zero security.
Base64 converts binary data into a string of 64 printable ASCII characters (A-Z, a-z, 0-9, +, /). It was designed to allow binary data to be transmitted over systems that only handle text, such as email. It is completely reversible by anyone, with no key required. Every programming language and countless online tools can decode Base64 in milliseconds.
The string SGVsbG8sIFdvcmxkIQ== looks like gibberish. But any developer — and any attacker — will immediately recognize it as Base64 and decode it to Hello, World! without any effort.
Despite this, Base64-encoded data is sometimes presented as if it were protected. You might encounter this in poorly written software, misleading tutorials, or — most dangerously — in systems where a developer applied Base64 "encoding" instead of actual encryption and convinced themselves the data was secure.
The difference:
- Encoding: A reversible transformation with no secret. Anyone can undo it. Base64, URL encoding, HTML entity encoding — these are all encodings.
- Encryption: A reversible transformation that requires a secret key. Without the key, the transformation cannot be reversed.
If you ever see a tool or service describe Base64 as a form of security or privacy protection, treat it as a red flag. The Encryptor / Decryptor applies genuine AES encryption — not Base64 — when you choose to encrypt.
Hashing vs. Encryption
Hashing is another concept frequently confused with encryption. The difference is fundamental:
- Encryption is reversible. Given the ciphertext and the key, you can recover the plaintext.
- Hashing is a one-way transformation. Given the hash output, you cannot recover the input — by design.
A hash function takes an input of any size and produces a fixed-size output called a digest or hash. Common hash algorithms include SHA-256 (produces a 256-bit output), SHA-512, and BLAKE3. MD5 and SHA-1 are older algorithms that are now considered cryptographically broken and should not be used for security purposes.
What Hashing Is Used For
Password storage: Websites should never store your actual password. Instead, they store a hash of your password. When you log in, they hash your input and compare it to the stored hash. If an attacker steals the database, they get hashes, not passwords — and cannot trivially reverse the hash to get the original password.
File integrity: Publishing the SHA-256 hash of a downloaded file lets users verify that the file was not corrupted or tampered with in transit. If even one bit of the file is changed, the hash changes completely.
Data fingerprinting: Two identical files will always produce the same hash. This lets you quickly detect duplicates or changes without comparing the full content.
Hashing Is Not Encryption
You cannot "decrypt" a hash. If you need to retrieve the original data later, you need encryption. If you only need to verify that data has not changed, hashing is appropriate. Choosing the wrong tool for the job is a serious security error — storing passwords encrypted rather than hashed means that anyone who gets access to the decryption key can read every user's password in plain text.
Keys, Passwords, and Why Strength Matters
The security of any encryption system depends entirely on the secrecy and strength of the key. An unbreakable algorithm with a weak key offers almost no protection.
What Is a Key?
A cryptographic key is a sequence of bytes — essentially, a very large number — that determines how the encryption algorithm transforms the data. AES-256 uses a 256-bit key, which is a number with 78 decimal digits. There are 2^256 possible AES-256 keys — approximately 1.16 × 10^77. Brute-forcing through all of them is not feasible with any conceivable computing technology.
The Password Problem
Most user-facing encryption tools ask for a password rather than a raw cryptographic key. This is more convenient, but it introduces a vulnerability: human-chosen passwords are predictable and have far less entropy (randomness) than a properly generated cryptographic key.
A common word like "password123" contains only a few bits of actual randomness from a cryptographic perspective, even though it satisfies many "password strength" requirements. An attacker does not need to try all 2^256 AES keys — they try common passwords and dictionary words, which is a much smaller search space.
To bridge the gap between a human-memorable password and a cryptographic key, well-designed encryption tools use a key derivation function (KDF) such as PBKDF2, bcrypt, scrypt, or Argon2. A KDF takes a password and makes it computationally expensive to test — so even trying a million passwords per second takes an attacker years to cover the likely password space.
The practical implication: a long, random passphrase is vastly more secure than a short complex password. "correct-horse-battery-staple" is more secure than "P@ssw0rd!" because it has more bits of entropy, even though it looks simpler.
Key Management
The strongest encryption is worthless if the key is not protected. Common key management mistakes:
- Storing the key in the same location as the encrypted data
- Including the key in source code that gets committed to version control
- Transmitting the key over an insecure channel
- Using the same key for multiple unrelated purposes
- Never rotating keys, so a single historical compromise exposes all past data
For personal use, the most important rule is: do not lose your key or password. Encrypted data is unrecoverable without it. There is no "forgot my password" reset for encryption — that would defeat the entire purpose.
When Should You Encrypt?
Encryption is a tool with real costs — complexity, key management overhead, and the risk of permanently losing access to your own data. It is appropriate in situations where confidentiality genuinely matters.
Good reasons to encrypt text or files:
- Sending sensitive personal information (Social Security numbers, financial details, medical information) over a channel that might be intercepted or logged
- Storing confidential notes or documents in a cloud service you do not fully control
- Sharing a secret (passwords, API keys, private addresses) through a messaging platform that does not offer end-to-end encryption by default
- Archiving sensitive historical records that should not be readable by anyone who gains access to the storage medium
Situations where encryption alone is not enough:
- Encrypting data on a device that is already compromised by malware — the malware may capture data before it is encrypted or intercept the key
- Encrypting communications with an untrusted recipient — encryption protects against third parties, not the person you are communicating with
- Storing encrypted data without a reliable backup of the key — the data becomes permanently inaccessible if you lose the key
Why Browser-Based Encryption Matters for Privacy
The Encryptor / Decryptor runs all cryptographic operations directly in your browser using the Web Crypto API, a browser-native set of cryptographic primitives that is available in all modern browsers. Your plaintext is never transmitted to any server.
This matters for several reasons:
No server logs: When encryption happens on a remote server, your plaintext necessarily travels across the network to reach that server. Even if the server immediately discards it after encrypting, the data passes through infrastructure that may log requests, and the transmission itself may be observed.
No third-party trust: You do not need to trust the tool provider with your sensitive data. The code runs on your machine, in a sandboxed browser environment, with no network requests for the actual encryption operation.
No account required: There is nothing to sign up for, no data associated with your identity, and no retention of any kind. The operation is entirely stateless.
Transparency: Browser-based tools that use the Web Crypto API rely on the browser's implementation of well-audited cryptographic algorithms rather than custom server-side code. You can inspect the network requests your browser makes to confirm no data is being sent.
Browser-based encryption is not suitable for every scenario — very large files may be slow, and you are relying on the browser environment being clean. But for encrypting text snippets and moderate-sized content, it is a practical and privacy-respecting choice.
Honest Limitations: What Encryption Cannot Guarantee
Good security guidance requires being honest about limitations. Even correctly applied strong encryption does not protect you from:
A compromised device: If malware on your computer captures your keystrokes as you type your password or records the screen before you encrypt, the encryption provides no protection. Security starts with a clean, updated device.
A weak password: Encryption is only as strong as the key. A short or guessable password allows an attacker to try common passwords and break the encryption without ever attacking the algorithm itself.
Social engineering: If someone tricks you into handing over your password, or into decrypting and sending the contents, encryption does nothing.
A backdoored implementation: If the tool you use has an intentional or accidental flaw in how it implements encryption, the mathematical strength of AES does not help. Use reputable, open-source, audited tools where possible.
Future computational advances: Quantum computers, if they become practical, would break many current asymmetric encryption schemes (RSA, ECC). They would reduce the effective security of AES by half (AES-256 would have roughly 128-bit security against a quantum attacker), which is still considered sufficient. Data encrypted today with AES-256 and stored for future decryption by a quantum computer is more at risk from weak passwords than from the algorithm itself.
Conclusion
Encryption is not magic and it is not impenetrable. It is a mathematically sound tool that, when used correctly, makes data unreadable to anyone who does not hold the right key. Understanding the basics — symmetric versus asymmetric encryption, what AES actually provides, the critical distinction between Base64 encoding and genuine encryption, and the irreplaceable importance of a strong and well-protected key — allows you to use encryption confidently and appropriately.
The Encryptor / Decryptor gives you access to real AES encryption running locally in your browser, with no server involvement and no data retention. It is a practical starting point for protecting sensitive text whenever you need to share it securely or store it safely.