Secure Notes

Encrypt a note with a password using AES-256-GCM, right in your browser — then decrypt it later or share it through an untrusted channel. Nothing is uploaded; the password never leaves your device.

No recovery. The password is the only key — there is no backdoor or reset. If you lose it, the note is gone for good. Keep the encrypted text and the password stored separately, and remember the strength depends on how strong your password is.

How Secure Notes works

Type your note, choose a strong password and press Encrypt. Your password is stretched into a 256-bit key with PBKDF2-HMAC-SHA-256 (a random salt and 210,000 iterations make guessing slow), and the note is sealed with AES-256 in GCM mode using a fresh random IV. You get a compact LKAES1… string you can save or send. To read it back, switch to Decrypt, paste the string, enter the same password and press Decrypt — if the password is wrong or the text was altered, it fails safely rather than returning garbage.

Everything runs locally through the browser's Web Crypto API, so your note and password never leave your device. Need a strong password to protect it with? Use the password generator.

Frequently Asked Questions

How does the encryption work?
Your password is turned into a 256-bit key using PBKDF2 with HMAC-SHA-256, a random 16-byte salt and 210,000 iterations, which slows down guessing. The text is then encrypted with AES-256 in GCM mode using a fresh random 12-byte IV. GCM adds an authentication tag, so decryption fails cleanly if the password is wrong or the data was altered. All of this uses the browser's built-in Web Crypto API.
Is my note or password sent anywhere?
No. Encryption and decryption happen entirely in your browser using the Web Crypto API. Your note, your password and the encrypted result are never uploaded, logged or stored on a server, and the tool works offline once loaded. Closing the tab discards everything.
What if I forget the password?
The note cannot be recovered. There is no backdoor, reset or master key — the password is the only thing that can derive the decryption key. Store the password somewhere safe and separate from the encrypted text; if you lose it, the data is gone for good.
How secure is it, really?
The algorithms — AES-256-GCM and PBKDF2 — are standard and strong, but the real strength depends on your password. A short or common password can be guessed regardless of the cipher, so use a long, unique passphrase. This tool is well suited to protecting personal notes or sharing a secret through an untrusted channel; for high-stakes needs, use dedicated end-to-end encrypted software and get expert advice.