01 / File Encryption Box

Encrypt and decrypt files online
Local AES-256, files not uploaded

Ready to use—no signup. Drop in a photo, video, or archive; this tab encrypts or decrypts it with AES-256-GCM, then downloads the ciphertext to this device. The file, passphrase, and filename never leave the browser. On decrypt, the original name is restored from the header. Short text secrets belong on Burn-Link.

Local streaming encryption 5 GB per file Files not uploaded No account
What to process

Local compute · not uploaded

File action

Drop a file here, or click to choose

Any type · max 5 GB per file

Output extension

Output extension

This file

Progress and download appear here after you choose a file

Ciphertext lives only in the file you download. A forgotten passphrase cannot be recovered. If any chunk fails verification, the run stops and no partial plaintext is written.

[ 02 ] How to use

How to encrypt and decrypt files online: drop a file, set a passphrase, download a .lock locally, then drop it back when you need to unlock it.

Drop a file and set a passphrase

01

Any type, max 5 GB per file. You alone keep the passphrase; if forgotten, it cannot be recovered. The page warns if it looks weak.

Encrypt locally and download

02

This tab encrypts in chunks with AES-256-GCM and outputs .lock or .enc. The file and passphrase are not uploaded. Progress is shown in bytes processed.

Decrypt or hand it off

03

Drop the ciphertext back and enter the same passphrase to restore the original filename. When you send it, do not put the passphrase on the same channel as the ciphertext.

[ 03 ] How it locks

Encrypt and decrypt both finish in the browser: read in chunks, encrypt, then assemble the download. FastPwd's servers see neither plaintext nor ciphertext.

The file is read locally only

01

After you drop or pick a file, the contents stay in this tab. The passphrase is derived with PBKDF2-HMAC-SHA256 (at least 100,000 iterations) into a 256-bit key, with a unique salt per file. Plaintext is not sent as a request body.

Encrypted in 1 MB chunks

02

Uses AES-256-GCM. Each chunk has its own IV and 16-byte tag. The header stores the original filename and MIME; after decrypt, the file downloads under that name.

Ciphertext lands on this device only

03

Output is .lock or .enc, downloaded by the browser. To restore, drop the ciphertext back and enter the same passphrase. For short secrets, use Burn-Link instead of sending a one-time link from this page.

[ 04 ] Verifiable

Is online file encryption safe? Rules you can check on the spot

File Encryption Box only answers how to lock a whole file locally. The algorithm, capacity, format, and what it cannot do are all on this page.

Algorithm
AES-256-GCM

Computation uses the browser Web Crypto API. Passphrase derivation is PBKDF2-HMAC-SHA256 with at least 100,000 iterations. Text mode can also use a 32-byte raw key (Base64 or Hex).

Capacity
5 GB

Any binary, max 5 GB per file, 1 MB chunks by default. Over the limit is rejected. Progress is shown in bytes processed. Text mode: up to 1,000 lines at a time, 10 KB per line.

Format
.lock v1

Magic is CSLK. The header holds salt, chunk size, optional filename and MIME; each chunk is then 12-byte IV + ciphertext + 16-byte tag. .enc and .lock have the same contents.

Cannot do
Passphrase cannot be recovered

A forgotten passphrase cannot be recovered. It cannot stop you from sending ciphertext and passphrase together to the wrong person. If any chunk's tag fails, the run stops and no partial plaintext is written.

[ 05 ] FAQ

Common file encryption questions

Files are not uploaded. Chunked read/write, key derivation, and AES-256-GCM all run in the current tab. The file, passphrase, and filename are not sent as an HTTP request and are not written to analytics. The server receives neither this plaintext nor this ciphertext.
The binary format is the same—FastPwd Lock v1: the header holds salt, chunk size, original filename, and MIME, followed by chunk-encrypted data. Only the extension differs. .lock is the default; switch when the recipient expects .enc.
No. The passphrase is only used to derive a key on this device. FastPwd has no copy and no recovery path. The page warns if the passphrase looks weak; if it is forgotten or guessed, the content cannot be recovered.
Use this page for photos, videos, archives, or anything over 32 KB; the ciphertext downloads to your device. Passphrases, API Keys, or recovery codes belong on Burn-Link: ciphertext is stored only temporarily, the key stays after # in the link, and it burns after the recipient opens it.
Send the downloaded .lock or .enc by cloud storage or email. Do not send the passphrase on the same channel as the ciphertext; you can pass the passphrase separately with Burn-Link. The recipient drops the ciphertext back on this page and enters the same passphrase to decrypt. FastPwd's servers never receive this file.
[ 06 ] Next
Locked then →

You can generate the file passphrase locally first. Do not stuff a short secret into a .lock—use a one-time link instead. Plaintext, keys, and files are not uploaded by default.

→ Open the password generator ↗ Burn-Link Password Audit