Free tool · AES-256 · stays on your device
Encrypt and decrypt text with a password
Turn a private message, bank details or a list of passwords into scrambled text that only someone with the password can read. The tool uses AES-256-GCM, a standard cipher used by banks and messaging apps, with a key made from your password by PBKDF2 (600,000 rounds). It all happens in your browser: your text and password are never sent to us or anyone else.
How to use the tool
- 1
Add your message
Paste or type the message. Anything up to a few MB works, including Hindi, Tamil and emoji.
- 2
Choose a strong password
Type it twice, or tap Generate for a random one. The meter shows roughly how hard it is to guess.
- 3
Encrypt and share
Copy the result that starts with qsk1., share it on WhatsApp, or download it as a .txt file.
- 4
Decrypt on the other side
The receiver opens this page, picks Decrypt, pastes the text and enters the password. Send the password some other way, like a phone call.
QRScanKaro
Need to lock a PDF instead?
Put a password on bank statements, salary slips and ID proofs with Protect PDF. AES-256, and the file never leaves your device.
Protect a PDF →Frequently asked questions
What happens if I forget the password?
The text cannot be recovered. There is no reset link and no master key: QRScanKaro never sees your password, and AES-256 can’t be broken by guessing a strong one. Keep the password in a password manager or somewhere safe.
How secure is this encryption?
It uses AES-256-GCM, a widely trusted standard that also detects if the encrypted text was changed. Your password becomes a key through PBKDF2-SHA256 with 600,000 rounds, which makes each guess slow. The weak point is the password: a short or common one can still be guessed, so use a long one.
Is my text sent to your server?
No. Encryption and decryption run in your browser with its built-in Web Crypto API. Your text, password and result never leave your device, and nothing is kept after you close the tab.
Why does the same text give a different result each time?
Every encryption uses a new random salt and IV (starting value). That is on purpose: it stops anyone from telling that two messages are the same. Both results decrypt to the same text with the same password.
What does “Wrong password or the text was changed” mean?
Either the password is different (check capital letters and spaces), or part of the encrypted text is missing or altered, which often happens when a long message is only partly copied. GCM checks every byte, so it refuses rather than showing wrong text.
More free tools
AES Encryption & Decryption
Encrypt and decrypt with AES-128, 192 or 256 using your own key and IV.
RSA Encryption & Decryption
Generate RSA key pairs (2048 or 4096-bit PEM), encrypt text with a public key and decrypt with the private key.
Hash Generator
Get MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of text or a file as you type.
Protect PDF
Password-protect a PDF with AES-256 encryption and optionally block printing, copying or editing.