encryptor.app
EN DE

How encryptor works

The facts behind encryptor 3.0: process, algorithms, file format, password, limits.

The process in 5 steps

  1. You choose text or a file. Your browser reads it locally. Nothing is uploaded.
  2. encryptor generates a password. 130 bits from your browser's secure random number generator.
  3. Argon2id derives a key. From the password and a random salt, with 64 MiB of memory and 3 passes. This makes every single guess expensive.
  4. AES-256-GCM encrypts. A random file key encrypts the data in 1 MiB blocks, together with the name and type. The file key is stored encrypted in the header.
  5. You send the result and the password separately. The .encrypted file or the ENCR3. text goes one way, the password another.

Algorithms

AES-256-GCMEncrypts data and metadata. Each block carries an authentication tag, so any change is detected.
Argon2idRFC 9106, recommended in BSI TR-02102-1. Parameters: m = 64 MiB, t = 3, p = 4. Turns the password into a key.
HKDF-SHA-512Derives separate keys for separate purposes.
HMAC-SHA-512Authenticates the header, including all parameters.

AES-256-GCM, HKDF and HMAC run through the Web Crypto API built into your browser. Argon2id runs through hash-wasm (WebAssembly), because the Web Crypto API has no Argon2id. hash-wasm is served from encryptor.app like every other file.

Format v3

Every file starts with a 140-byte header. It contains:

  • the identifier ENCR
  • the format version
  • the Argon2id parameters
  • the salt
  • the nonce
  • the encrypted file key
  • an HMAC over the header

The data follows in 1 MiB blocks. Each block is bound to its position and to the end of the file. Removed, reordered, or appended blocks are detected.

Metadata such as the original name and type are encrypted.

Padding based on the PADMÉ scheme hides the exact size. The approximate size stays visible.

Encrypted text uses the same format, written as ENCR3. followed by Base64url.

Password

  • Always generated. You cannot set your own password, so every password has a known strength.
  • 130 bits of randomness.
  • 26 characters in Crockford Base32: digits and letters except I, L, O, and U, which are easy to confuse.
  • 2 additional check characters to detect typing errors.
  • Shown in groups of four.
  • encryptor does not store the password.

Time to crack

The only way in without the password is guessing it. The calculation, with every assumption stated:

Assumptions

  • 1 million RTX 5090 GPUs.
  • About 3,000 Argon2id guesses per second per GPU, each paying the full Argon2id cost.
  • Average case: the password is found after half of all possibilities have been tried, that is, after 2¹²⁹ guesses.

2¹²⁹ guesses ÷ (10⁶ GPUs × 3,000 guesses per second) ≈ 2.3 × 10²⁹ seconds

About 7 × 10²¹ years. That is about 500 billion times the age of the universe (13.8 billion years).

More hardware shortens the time proportionally. With 1,000 times the computing power, it is still about 7 × 10¹⁸ years.

Version 2 stays readable

Texts and files from version 2 can still be decrypted. encryptor no longer creates version 2 data.

Version 2 used AES-256-GCM with PBKDF2-SHA-256 and 100,000 iterations, with a password chosen by the user.

The security of existing version 2 data depends on the password chosen at the time.

What encryptor doesn't protect

  • Metadata. The approximate file size and who talks to whom stay visible.
  • A compromised device. If the device itself is infected, encryptor can't help.
  • A lost password. Without it, the data is gone. There is no recovery.
  • A password sent with the file. Always use a separate channel.
  • Altered code. Your browser runs the code this site delivers and has to trust it. That is why we publish checksums for every file.

Checksums

SHA-256 checksums of every file served on this site are listed below and in the GitHub release.

0c4243f4ea4d8c5ff36a5f599b344b98489f2d426f6694a0b5483c4cd3c454b9  a/7d739eaf5a/core/bytes.js
9a1c8816065389c2c5dd8f0fcb7263ff52e21e0e25d915a5f9c367a52d5870b5  a/7d739eaf5a/core/crack-time.js
330fabe751bc5c1b918c885f28ea4af73d327c46a8e626717dfd4b424d433e55  a/7d739eaf5a/core/detect.js
66d650563ea1179b99f19775f6d07e80c47c32e19c95ff4c0362c63884e95ca6  a/7d739eaf5a/core/format-v3.js
7505a9870d76735a1a4be0b891f96a15e043cc5d089eacbf8ee4df42dc6a9cbc  a/7d739eaf5a/core/generator.js
68730265a4b3d788f82e2e9f56a8190c134f9a6406ad77e8f1caf861857e08ef  a/7d739eaf5a/core/kdf.js
eda2b46daf1bddf3597bd9f3f09eec2e2dc7e28bd2ee94492bb1d677fc2bd3b8  a/7d739eaf5a/core/legacy-v2.js
0d014df74f05e332b2c39b80415aad27dff6fa6e2b47d33d51ea307442d39198  a/7d739eaf5a/core/sanitize.js
dcec617a2e1b700fa132d1583a186cb70611113395e869f2dd6cc82b415d3094  a/7d739eaf5a/hash-wasm-argon2.js
31e6c5eca3877d73fbcb6ea5b2bcda4430855e0d93d4fcfe4e0d069688e57d45  a/7d739eaf5a/site.css
db7ad3710fe8851894bd71889ba41404141b8094e512defb6ab4079ab081d0d0  a/7d739eaf5a/site.js
00c97a49dce180b6a94bf0c876a2cfdfcd575b2e6821ab8920e750b9af316b9d  a/7d739eaf5a/theme.js
a0de0c61ef6423ed698081009a0b8438bb7e798d7679ded48a72ca2ddbe8ebba  a/7d739eaf5a/ui/contact.js
eda91156d64cc3f57654074accc18c2e425117aee44f02cf2ca1aa0414ac1330  a/7d739eaf5a/ui/decrypt-file.js
5f559b282a32c34ad78053609452845097f0e27ae089466a255e84d5555e1121  a/7d739eaf5a/ui/decrypt-text.js
429723fca270eb9c79bc2baa107b2934b182b66bafd20e86bdea6b7e5d8e7819  a/7d739eaf5a/ui/encrypt-file.js
61882f5fca076841a8326f22b729b76bf675be63817179ecd190d145e1ac5c59  a/7d739eaf5a/ui/encrypt-text.js
0d64a98a7a237b64914423c3dc04dbed2c1ffa2877c37648ec1cdf5dd7027f51  a/7d739eaf5a/ui/ui.js

Check a file yourself

macOS and Linux: shasum -a 256 <file>

Windows: certutil -hashfile <file> SHA256

Specification

The complete specification of format v3 and the source code of the web version are on GitHub.

View on GitHub

Encrypt now