Encrypt a message with a secret word
Write a message, choose a secret word, and we hand back a block of text that says nothing to anyone who does not know it. Paste it into WhatsApp, into an email, or write it on paper. Whoever has the key opens it right here.
Everything happens in your browser
The longer the better. A whole phrase is far stronger than one word with odd symbols in it.
The hard part is not the encryption, it is the key
Agree the secret word over a different channel from the one you will send the message on. Say it in person, over the phone, or use something only the two of you already knew. If it travels in the same chat as the message, you have protected nothing.
What it actually does
- AES-256 encryption in GCM mode, the standard banks and governments use.
- Your key becomes a real key via PBKDF2-SHA256 with 600,000 rounds.
- Every message uses a fresh, random salt and initialisation vector.
- The format carries its own version, so it can be improved without orphaning old messages.
- All of it through the browser's own cryptography. We have not written a single line of crypto.
What this does NOT do
- It protects the contents, not the fact they exist. It is still visible that you sent something, and to whom.
- If you share the key over WhatsApp, the key is on WhatsApp. That is nearly always the weak link.
- Forget the key and the message is gone. There is no recovery, and that is exactly what makes it secure.
- It handles text, not files. And it does not sign: it proves nobody altered the message, not who wrote it.
This tool runs entirely inside your browser. There is nothing to upload, so there is nothing we can see, store or lose. You can disconnect from the internet and it will still work.
Frequently asked questions
What kind of encryption does this tool use?
AES-256 in GCM mode, which both encrypts and detects whether the message was altered. The secret word becomes a key via PBKDF2-SHA256 with 600,000 rounds, and every message uses a fresh, random salt and initialisation vector. Everything runs through the browser’s own cryptographic functions: we have not written a single line of our own cryptography. The exact parameters are set out on the security page.
How do I give the secret word to the other person?
Over a different channel from the one carrying the message. Said in person, over the phone, or something the two of you already knew. If the key travels in the same chat as the encrypted message, you have protected nothing: whoever reads the conversation has both halves. This is the part that fails in practice, not the encryption.
What happens if I forget the secret word?
The message is lost, permanently. There is no recovery, no back door, and no way for us to help, because we hold neither the message nor the key. That is not a limitation: it is precisely what properly encrypted means.
Why does it take almost a second to encrypt?
Because the slowness is the protection. Turning the secret word into a key deliberately costs 600,000 repetitions of a calculation. Anyone trying to guess the key by running through millions of possibilities pays that same wait on every single attempt, which turns an attack measured in hours into one measured in years.
Is this as secure as Signal or WhatsApp?
No, and it is for something different. Signal continuously establishes fresh keys between two devices and also protects the metadata of the conversation. This encrypts a block of text with one shared key that the two of you manage, and it is visible that a communication happened even if its contents are not. It is useful precisely when you cannot install anything: it works over email, in a document, or written on paper.