🔐 File Encryption Tool
Password-protect any file with AES-256-GCM, the same cipher class protecting your bank connection, entirely on your device.
AES-256-GCM · PBKDF2-SHA256, 310,000 iterations · runs offline. Forgotten password = unrecoverable data, by design.
How the file encryption tool works
Your password is stretched into a 256-bit key with PBKDF2 (310,000 iterations of SHA-256, per current OWASP guidance) and a random 16-byte salt, then the file is encrypted with AES-256-GCM using a random nonce. GCM is authenticated encryption: decryption verifies integrity, so a tampered or corrupted file fails loudly instead of decrypting to garbage. Salt and nonce are stored in the output file header. They are not secrets; the password is.
The honest limits: this protects the file's contents, not its existence or size, and the protection is only as strong as the password, use a long random one from a generator. And there is no recovery: lose the password and the data is mathematically gone. That is the feature.
Frequently asked questions
How strong is the encryption?
AES-256-GCM via the browser's Web Crypto API, the same primitive used in TLS 1.3. The practical attack is never the cipher; it is a guessable password. Pair this tool with a generated 16+ character password and the encryption is not the weak point.
Can I recover the file if I forget the password?
No. There is no back door, no reset, and LazyTools never sees the file or the password. Store the password in a password manager before you delete the original.
What is the .enc file it produces?
A small header (format marker, random salt, random nonce) followed by the AES-GCM ciphertext. Decrypt it with this same tool. The salt and nonce being visible is by design, their job is uniqueness, not secrecy.
Why PBKDF2 with 310,000 iterations?
Key stretching makes each password guess expensive: an attacker must repeat all 310,000 hash rounds per attempt. The figure follows OWASP's current recommendation for PBKDF2-HMAC-SHA256.
Is the file uploaded during encryption?
No, reading, key derivation, encryption and download all happen in browser memory. Disconnect from the internet and it works identically.
Related privacy & security tools
From the blog
-
What Your Photos Reveal: EXIF, GPS Location and How to Strip Them
EXIF metadata in phone photos includes camera, timestamps and GPS coordinates accurate to a few meters. What leaks, and how to strip it in your browser.
-
How to Password-Protect a PDF (or Remove a Password) Without Uploading It
PDF encryption uses AES, but online unlock tools want your document and its password together. How PDF passwords work and how to add or remove them locally.