Protect any text with a passphrase. Everything happens in your browser — no data leaves your device.
Uses PBKDF2 key derivation with AES-256-GCM encryption.
Your passphrase and plaintext never leave your browser.
Generate a memorable random-word passphrase privately in your browser, then return here to encrypt your text.
Open the passphrase generator →Browser-based text encryption
SecretPost is a free online tool to encrypt and decrypt text with a passphrase. Paste in a message, choose a passphrase, and it is scrambled into ciphertext you can safely paste into an email, chat, or note.
Everything runs locally in your browser. Your passphrase and your plaintext are never uploaded — there is no account to create and nothing to send to a server.
Type or paste the text you want to protect, enter a passphrase, and press Encrypt. The tool turns your message into an unreadable block of ciphertext that only someone with the same passphrase can open.
Share the encrypted output through any channel you like — email, a messaging app, a shared document — and share the passphrase separately, through a different channel. Anyone who intercepts the ciphertext without the passphrase sees only random-looking text.
To read an encrypted message, switch to the Decrypt tab, paste the ciphertext, and enter the exact passphrase that was used to encrypt it. The original text is recovered instantly in your browser.
The passphrase has to match character for character. There is no recovery option and no backdoor: if the passphrase is lost or mistyped, the original text cannot be retrieved — which is exactly what makes the encryption strong.
SecretPost uses the Web Crypto API built into modern browsers. Your passphrase is stretched into a 256-bit key with PBKDF2, and that key encrypts your text with AES-256-GCM — the same authenticated encryption used to protect data across the web.
Because the cryptography happens on your device, the work never leaves the page. There is nothing to install and no data is transmitted while you encrypt or decrypt.
SecretPost is built for one focused job: encrypting and decrypting text with a passphrase. To set expectations clearly, here is what it is and is not.
Your passphrase and plaintext never leave your browser, so the security of a message comes down to the strength of the passphrase and how carefully you share it.
FAQ
No. Encryption and decryption happen entirely in your browser using the Web Crypto API. Your passphrase and your text are never uploaded to SecretPost or anyone else.
The text cannot be recovered. There is no reset, recovery, or backdoor — only the exact passphrase used to encrypt the text can decrypt it. Store your passphrase somewhere safe.
Yes. AES-256-GCM is a widely trusted authenticated encryption standard used across the modern web. SecretPost derives the key from your passphrase with PBKDF2 before encrypting.
Yes. Open SecretPost on any device, go to the Decrypt tab, paste the ciphertext, and enter the same passphrase. The text is decrypted locally on that device.
No. SecretPost encrypts and decrypts text only. Paste the text you want to protect into the box — it does not handle files, images, or folders.
No. There is no sign-up and nothing to install. Open the page, type your text and passphrase, and encrypt or decrypt right away.
Looking for a different way to share something private? These tools work alongside browser-based text encryption.