AES-GCM encrypt
Encrypt a file with AES-256-GCM under a password, on your device.
Runs on your device. The file is never uploaded.
AES-GCM encrypt stretches your password into a 256-bit key with PBKDF2-HMAC-SHA256, running it 210,000 times. A random 16-byte salt, a random 12-byte IV and the ciphertext then go into one file, named by adding .aesgcm. Nothing else joins them: no hint and no parameter record, so a forgotten password ends the file.
Questions
Is AES-GCM encrypt secure enough for a real file?
The algorithm is standard and the weak link is your password. The tool uses AES-256-GCM through your browser Web Crypto, and derives the key from your password with PBKDF2-HMAC-SHA256 at 210,000 iterations over a fresh random 16-byte salt. GCM adds an authentication tag, so tampering is detected rather than silently decrypted. None of that helps if the password is short or guessable, because anyone holding the file can attack it offline at their own pace.
Where does my password go?
Nowhere. The tool runs in a Web Worker inside this tab. Your password is turned into a key by crypto.subtle in the page, and it is never stored, never sent and never written to disk. There is no account and no server side to this tool, so there is nothing to leak. Close the tab and the password is gone from memory, which also means nobody can recover it for you later.
What is inside the .aesgcm file?
Three parts, in order: a 16-byte random salt, a 12-byte random IV, then the AES-GCM ciphertext with its authentication tag. The output is your input name with .aesgcm added, so notes.txt becomes notes.txt.aesgcm. Nothing else is stored: no password hint, no original filename, no iteration count. AES-GCM decrypt reads exactly this layout, which is why it opens files this tool produced and nothing else.
How do I decrypt it again?
Use AES-GCM decrypt on this site with the same password. It strips the .aesgcm suffix to name the result, so notes.txt.aesgcm comes back as notes.txt. Another program can open it too, as long as it reads the same salt, IV and ciphertext layout and rederives the key with PBKDF2-HMAC-SHA256 at 210,000 iterations. There is no password recovery anywhere in the chain.
Why is the output different every time I encrypt the same file?
Because the salt and the IV are freshly random on every run. crypto.getRandomValues fills 16 bytes of salt and 12 bytes of IV each time, so the same file with the same password gives different bytes each time. That is deliberate: reusing a GCM IV under one key breaks the scheme. It also means you cannot compare two outputs to check whether they hold the same content.
Can I encrypt several files at once?
Yes. Drop as many as you like. Each file is encrypted separately and comes back as its own .aesgcm download, with its own random salt and IV, and the password applies to all of them in that run. Filenames are not encrypted, only file contents, so anyone who sees the output can still read what the original was called.