Protected Text — Encrypted Notepad Online

Lock any text with a password using AES-256 encryption, right in your browser. Nothing is uploaded or stored.

Your browser does not support the Web Crypto API, so encryption cannot run here. Please use a recent version of Chrome, Edge, Firefox, or Safari over HTTPS.
Please note: this is a demo-grade tool for fun and learning — handy for puzzles, surprises, and casual privacy, but not for real secrets like banking credentials or sensitive documents. For those, use a dedicated password manager or established encryption software.

How This Protected Text Tool Works

AES-256 Encryption in Your Browser

When you press Encrypt, your browser derives a 256-bit key from your password using PBKDF2 with 150,000 iterations — a deliberate slowdown that makes brute-force guessing expensive — and encrypts your text with AES-256-GCM, the authenticated encryption standard trusted by banks and governments. The output is a single portable code in the shape iv:ciphertext: a random 12-byte initialization vector, then the encrypted data, both in base64. Everything runs on the Web Crypto API built into your browser.

Your Password and Notes Never Leave Your Device

This page has no server component at all. Your text is not uploaded, your password is not transmitted, and there is no database anywhere holding even an encrypted copy. The only copy of anything is the one you keep yourself.

Save, Share, or Store Your Encrypted Code

The encrypted code is just text — safe to email, message, or store anywhere, because without the password it is meaningless noise. To read it again, paste the code back into the text box, enter the password, and press Decrypt — on any device, any time.

Why It Is Safe: Zero-Knowledge by Design

No Server Storage — Nothing to Hack or Leak

Every data breach you have read about had one thing in common: a server holding user data. This tool removes that ingredient entirely. There is no account to compromise and no database to dump — the security model is not "trust us with your secrets" but "we never have your secrets."

Honest Limits: The Password Is Everything

Zero-knowledge cuts both ways. Because no one else holds a key, a forgotten password means the text is gone — there is no reset email and no recovery, by design. Use a password you will remember (a long phrase beats a short jumble), and remember that encryption is only as strong as the password in front of it.

How to Password-Protect Text — Step by Step

  1. Type or paste your text into the box above — notes, a private message, a journal entry, a surprise.
  2. Choose a strong password and type it into the password field.
  3. Press Encrypt. Your text becomes an iv:ciphertext code in under a second.
  4. Keep the code anywhere. Copy it into an email, a file, or your notes app.
  5. To read it later, paste the code back into the text box, enter your password, and press Decrypt.

To share protected text with someone else, send them the encrypted code through one channel and the password through a different one — code by email, password by phone call, for example. They decrypt it right on this page with nothing to install.

A Note on What This Is For

This tool uses real AES-256-GCM cryptography, but it is still a demo-grade utility built for fun, learning, and casual privacy — puzzles for friends, surprise messages, diary entries you would rather keep scrambled. It is not a substitute for a dedicated password manager or audited encryption software when the stakes are genuinely high. Treat it accordingly: great for everyday secrets, not for anything that would hurt if lost.

Frequently Asked Questions

What encryption does this protected text tool use?+

AES-256-GCM authenticated encryption, with keys derived from your password via PBKDF2 (SHA-256, 150,000 iterations) and a fresh random 12-byte IV for every encryption. It runs on the Web Crypto API — the audited cryptography engine inside your browser.

I forgot my password — can my text be recovered?+

No, and that is the point. No one — including us — can decrypt your text without the password, because no one else ever has it. Treat the password like the physical key it is.

Is my text sent to a server?+

Never. Encryption and decryption happen locally in your browser. You can even load this page, disconnect from the internet, and the tool keeps working.

Can I decrypt my text on another device?+

Yes. The iv:ciphertext code is self-contained — bring it to this page on any modern browser, enter the same password, and it decrypts.

What does "wrong password" mean?+

It means decryption failed: either the password does not match, or the code was altered or pasted incompletely. AES-GCM detects any tampering, so even one changed character makes the whole code undecryptable.

Is this tool free?+

Completely free, no account, no limits. It costs nothing to run precisely because there is no server infrastructure behind it.

More Free Text Tools

Protection is one kind of hidden text — Invisible Texts specializes in the other kind too:

Unicode Text Converter Discord Timestamps Generator Free Fire Invisible Space Text to Voice

Conclusion

Locking a note with a password should not require an account, an app, or trusting a stranger's server. With real AES-256 encryption running entirely in your browser, this protected text tool turns any message into a portable scrambled code that only your password can open. Just remember its limits: it is a demo-grade tool for fun and casual privacy — and never forget the password, because no one can recover it for you.

Frequently Asked Questions

It is a free online notepad that encrypts your writing with a password before anyone else can read it. You type or paste text, choose a password, and the tool scrambles the content into an encrypted code using AES-256. Only someone with the exact password can turn it back into readable text. There is no account, no signup, and nothing is ever uploaded to a server.
When you press Encrypt, your browser derives a 256-bit key from your password using PBKDF2 with 150,000 iterations, then locks your text with AES-256-GCM, a widely trusted encryption standard. A fresh random initialization vector is generated every time, so encrypting the same text twice produces completely different output. Everything happens locally through your browser's Web Crypto API.
No. There is no registration, login, username, or email required at any step. The tool runs entirely in your browser with no user database behind it. This is deliberate: with no accounts, there is nothing to hack, leak, or link back to you. You open the page, type your text, set a password, and encrypt.
Your text is lost permanently. Because encryption happens only in your browser and no copy of your password exists anywhere, nobody — not even the site owners — can recover it. There is no 'forgot password' link and no backdoor. Always store your password somewhere safe, like a password manager, before encrypting anything important.
No. Your text and password never leave your device. Encryption runs in your browser's memory, and the site has no server component receiving your data. The owners only ever see the same public web page you do. Even if someone seized the servers, there would be nothing to find — there is simply no database of notes or passwords.
Nothing is uploaded. The page contains no analytics on the tool, no form submissions, and no network calls during encryption or decryption. You can verify this yourself: open your browser's developer tools, watch the Network tab while encrypting, and you will see zero requests. You can even disconnect from the internet after the page loads and it keeps working.
Type or paste your text into the text box, enter a strong password in the password field, and click Encrypt. The tool will display an encrypted code — a long string beginning with an initialization vector, followed by the scrambled text. Copy that code and save it somewhere safe. Anyone who wants to read it will need both the code and your exact password.
Paste the full encrypted code into the text box, type the exact password that was used to encrypt it, and click Decrypt. If the password matches, your original text appears instantly. If even one character of the code or password is wrong, decryption fails and you will see an error instead of garbled text, because AES-GCM verifies integrity before revealing anything.
It is a long string of seemingly random characters in the format 'iv:ciphertext' — an initialization vector, a colon, then the encrypted data. It is deliberately unreadable: it reveals nothing about the length of your password, the content, or the language of the original text. Treat it like a locked safe; the password is the only key.
Send them the encrypted code through any channel — message, email, or a shared document — and give them the password through a different channel, such as telling them in person or calling them. They paste the code into the same tool on this site, enter the password, and click Decrypt. They do not need an account either.
No — that defeats the purpose. If someone intercepts a single message containing both the locked code and the key, your encryption is worthless. Always split them: send the code by email and the password by text message, for example, or share the password verbally. Two separate channels mean an attacker must compromise both to read your note.
Yes, after the page has loaded once. Since all encryption happens in your browser with no server calls, you can disconnect from the internet and keep encrypting and decrypting. This is also a good privacy practice: working offline guarantees nothing can possibly be transmitted while you handle sensitive text.
Any modern browser with the Web Crypto API: recent versions of Chrome, Edge, Firefox, and Safari, on desktop and mobile. If your browser is too old to support it, the tool will show an error instead of silently using weaker methods. Keeping your browser updated is the simplest way to stay compatible and secure.
There is no artificial limit set by the site — no character cap, no daily quota, no paid tier. Practical limits come only from your device: extremely long texts (hundreds of thousands of characters) may take a few seconds to process and produce very long codes. For everyday notes, messages, and documents, you will never hit a wall.
Yes. The tool encrypts the raw Unicode data of your text, so emojis, right-to-left scripts, accented characters, and symbols from any language survive encryption perfectly. Decryption restores every character exactly, byte for byte. If your original text displays correctly in the box, it will come back identical after a decrypt round-trip.
Length beats complexity: aim for at least 16 characters, ideally a memorable passphrase of four or more random words. Avoid dictionary words alone, birthdays, and passwords you reuse elsewhere. Because PBKDF2 with 150,000 iterations slows guessing but cannot save a weak password, a short or common password remains the weakest link.
Yes, completely. 'Sunshine' and 'sunshine' produce entirely different encryption keys, and only the exact original will decrypt your text. The same applies to spaces, punctuation, and invisible characters. Copy-paste your password carefully when sharing it, and double-check for trailing spaces, which are a common cause of failed decryption.
Yes — spaces, symbols, numbers, and Unicode characters are all accepted and all strengthen your password. A passphrase like 'correct horse battery staple' is both strong and memorable precisely because spaces count. Just remember that every character matters: you must reproduce the password exactly, spaces included, to decrypt.
No. This is not a live synced document like Google Docs. It is an encrypt-and-decrypt utility: you lock text into a code, share the code, and the other person unlocks their own copy. There is no shared live page and no real-time collaboration. If you both edit separately, you will end up with two different encrypted codes.
The concept is similar — password-protected notes with no account — but the mechanics differ. Protectedtext.com hosts your encrypted note on its servers under a URL you choose. This tool has no servers at all: it only scrambles and unscrambles text in your browser, and you are responsible for storing and sharing the resulting code yourself.
No. It is honestly described as demo-grade: real AES-256 encryption, but built for fun, learning, puzzles, and casual privacy — not for high-stakes secrets. Banking credentials, medical records, and legal documents deserve dedicated, audited tools like a proper password manager or end-to-end encrypted storage with a professional security track record.
It means the cryptography itself is genuine — AES-256-GCM via your browser's Web Crypto API — but the surrounding product is a simple web utility, not a hardened security product. There has been no independent security audit, no bug-bounty program, and no enterprise key management. Use it for surprises, journals, and puzzles, not for secrets whose exposure would cause real harm.
Yes, automatically. AES-GCM is authenticated encryption: it embeds a verification tag that is checked during decryption. If anyone alters even a single character of the code, decryption fails outright instead of producing corrupted text. You will never silently read a modified message — the tool refuses to decrypt tampered data.
Decryption fails with an error. Because of the authentication tag, the tool cannot mistake a corrupted code for a valid one, so it will not show you garbled or half-readable text. Double-check that you copied the entire code, including the beginning and end, with no missing or extra characters.
No, and that is intentional. Each encryption generates a fresh random initialization vector, so identical text and password still produce completely different codes every time. This is a security feature: it prevents anyone from noticing that two codes contain the same message, which could leak information about what you are communicating.
It is a random value, generated fresh for every encryption, that ensures identical plaintexts encrypt to different ciphertexts. The IV is stored openly at the start of your encrypted code (before the colon) — it is not secret. Its only job is uniqueness: without it, patterns in your messages could become visible to an observer comparing codes.
PBKDF2 is a key-derivation function that turns your password into a 256-bit encryption key while deliberately taking noticeable computing time — here, 150,000 rounds. This slowness is a defense: it makes brute-force password guessing enormously expensive for an attacker, while remaining a fraction of a second for you. It is the standard way to convert human passwords into cryptographic keys.
It depends entirely on your password's strength. PBKDF2's 150,000 iterations force an attacker to spend real computing time per guess, which defeats casual attacks — but a short or common password can still fall to a determined attacker with powerful hardware. A long, unique passphrase makes brute force practically infeasible. The math protects strong passwords, not weak ones.
No. Encryption protects your text in transit and at rest, but if your device itself is compromised — a keylogger recording keystrokes, malware reading your screen — no browser tool can help. The tool assumes your device is trustworthy. For sensitive use, keep your operating system updated, use reputable antivirus software, and avoid public or shared computers.
Yes. The encrypted code is fully self-contained: it carries everything needed except the password. Copy the code to your phone, another computer, or any device with a modern browser, open this tool, paste the code, enter the password, and decrypt. No syncing, accounts, or pairing is involved.
Yes. The tool is a standard web page using the Web Crypto API, which mobile Chrome, Safari, Firefox, and Edge all support. The layout adapts to small screens. Just make sure your mobile browser is updated — very old versions may lack the cryptography functions and will show an error instead of encrypting.
No. Your password exists only in the page's temporary memory while you encrypt or decrypt, and it is discarded as soon as you navigate away, refresh, or close the tab. It is never written to cookies, local storage, browser history, or any server. Each visit starts with a blank slate.
Yes — it is just text. Paste it into any text file, note app, email draft, or USB stick. Because the code is self-contained and the tool needs no account, a file backup works perfectly: months later, paste the code back into the tool with your password and decrypt. Just keep the password stored separately and safely.
Encrypt your message, copy the resulting code, and paste it into your WhatsApp chat or email like ordinary text. Then share the password through a different channel — for example, tell the recipient in person or via a phone call. They open this tool, paste the code, enter the password, and read your message.
Yes. Encrypt the text once with the first password and save that code, then encrypt the original text again with the second password to get a different code. Each code is independent: losing one password does not affect the other. This is handy when sharing the same note with two people who should not share a password.
The tool handles plain text, so line breaks and spacing are preserved exactly, but rich formatting such as bold, colors, fonts, and images is not — paste formatted text and only its characters survive. If you need formatting, describe it in words or use a format like Markdown, whose symbols are plain text and round-trip perfectly.
Yes. Source code is plain text, so it encrypts and decrypts perfectly, including indentation, brackets, and special symbols. Developers sometimes use it to share API keys or config snippets through insecure channels. Just remember the demo-grade caveat: for production secrets, prefer a proper secrets manager over a browser utility.
You get a clear failure, not a wrong answer. AES-GCM authentication means the tool can mathematically tell the password is incorrect, so it refuses to decrypt rather than showing scrambled text. Check for typos, caps lock, and trailing spaces, then try again. After several failures, consider that you may be misremembering the password.
Nothing. The tool is a web page using cryptography built into your browser — no extensions, apps, or downloads. This is also a security advantage: there is no installer that could be tampered with. As long as you are on the genuine site over HTTPS, what you see is what runs.
Completely free, with no limits, no premium tier, and no ads inside the tool. It costs nothing to operate precisely because there is no server infrastructure — your browser does all the work. There is no catch and no upsell; the tool exists as a free utility alongside the site's other text tools.
Yes, it works well for that: write entries, encrypt them with a memorable password, and store the codes in a folder or document. Since nothing is uploaded, your diary cannot be breached from the site's side. Just keep two things safe — the encrypted codes and the password — because losing either means losing the entries forever.
Absolutely — that is one of its best uses. Encrypt clues with a password that players must discover, then hide the codes around a website, a classroom, or a party. Because each encryption produces unique output and wrong passwords fail cleanly, it makes a fair, tamper-evident puzzle mechanic with zero setup.
Technically yes, but think carefully. Encrypting an exported vault adds a layer of obscurity, yet a password manager's own encryption is already strong, and stacking tools adds complexity without much gain. If you do it, use an extremely strong unique password — your entire digital life would depend on it — and remember the demo-grade limits.
It almost always means your browser lacks Web Crypto API support — typically a very old version, an unusual embedded browser, or an insecure HTTP context. Update to the latest version of Chrome, Edge, Firefox, or Safari and make sure you are on the HTTPS site. If the error persists, try a different browser before assuming anything is broken.
Never. The code is static text with no timestamp, no server record, and no self-destruct mechanism. It remains decryptable indefinitely — years later, on any device — as long as you have the code and the password. There is no way to set an expiry, so do not rely on it for messages that must become unreadable.
Three easy checks: open browser developer tools and watch the Network tab while encrypting — you will see no requests; disconnect from the internet after loading the page and confirm it still works; or view the page source and confirm there is no form submission or fetch call. The tool's honesty is verifiable, not a matter of trust.
Yes, and they survive perfectly. Since the tool encrypts raw Unicode, zero-width characters and other invisible code points in your text are preserved byte-for-byte through encryption and decryption. This pairs naturally with the site's invisible-text tools if you want to layer techniques — though for most purposes, the encryption alone is sufficient.
Avoid it. While the encryption itself is sound, public computers may have keyloggers, screen recorders, or cached page data left behind for the next user. If you must, use the browser's private mode, never save the password, and close the tab when done — but a trusted personal device is always the safer choice.
Not directly, but it takes seconds: decrypt the code with the old password, then encrypt the recovered text with the new password to get a fresh code. Securely delete the old code afterward. This re-encryption also generates a new random IV, so the new code looks completely unrelated to the old one.
Anyone handling legally protected, life-critical, or high-value secrets — journalists protecting sources, activists under surveillance, businesses with compliance duties — should use audited, professionally maintained encryption products instead. This tool is excellent for everyday privacy, learning, and fun, but it was never designed or reviewed for adversarial, high-stakes scenarios.