Encrypt Text Online: Free AES Encryption Without Software

You have a piece of text that needs to stay private. A password, a personal note, sensitive instructions, financial details, or a message meant for only one person's eyes. You could install encryption software like GPG, learn command-line tools, or set up a PGP key pair. Or you could encrypt it right now, in your browser, in about 15 seconds.

Browser-based encryption has matured to the point where you no longer need to download anything to protect sensitive text with military-grade encryption. Here is how it works, why it is safe, and how to do it.

How AES-256 Encryption Works

AES stands for Advanced Encryption Standard. The "256" refers to the key length in bits. It is the same encryption standard used by the U.S. government for classified information, by banks for financial transactions, and by every modern VPN service.

The Basic Process

1. Plaintext -- Your original readable message
2. Key -- A password or passphrase that controls the encryption
3. Encryption -- AES algorithm transforms plaintext into ciphertext using the key
4. Ciphertext -- The encrypted output, which looks like random characters
5. Decryption -- The same key reverses the process, recovering the original plaintext

Why AES-256 Is Considered Unbreakable

The 256-bit key means there are 2^256 possible combinations. That is approximately 1.15 x 10^77 -- a number so large that if every atom in the observable universe were a supercomputer trying every possible key, it would still take longer than the age of the universe to crack a single AES-256 encrypted message by brute force.

Symmetric vs. Asymmetric Encryption

AES is symmetric encryption, meaning the same key encrypts and decrypts. This is different from asymmetric encryption (like RSA or PGP), where you have a public key and a private key. Symmetric encryption is faster and simpler, but it requires you to share the key with your recipient securely.

End-to-End Encryption Explained

"End-to-end encryption" (E2E) means the encryption and decryption happen on the endpoints -- your device and the recipient's device -- and nowhere in between.

When a service claims E2E encryption, it means:

• The server never sees the plaintext
• The password never leaves your browser
• Even if the server is hacked, attackers only get ciphertext (useless without the key)

This is different from "encryption in transit" (HTTPS), which protects data between your browser and the server, but the server itself can read your data.

Type	Your Browser	Server	Recipient
No encryption	Readable	Readable	Readable
Encryption in transit (HTTPS)	Readable	Readable	Readable
Server-side encryption	Readable	Encrypted at rest, readable in memory	Readable
End-to-end encryption	Readable	Encrypted (unreadable)	Readable

The Problem with Server-Side Encryption

Many "encrypted" note services encrypt your data on their server, not in your browser. This means:

• The server receives your plaintext
• The server encrypts it for storage
• The server decrypts it when the recipient requests it
• The server has access to the encryption key

If the service is compromised, or if an employee decides to peek, or if a government issues a subpoena -- your "encrypted" data is readable because the server holds the key.

Services like Privnote and OneTimeSecret use this model. They are better than nothing, but they are not true end-to-end encryption.

How LOCK.PUB Handles Encryption

LOCK.PUB uses a client-side encryption model that works like this:

When You Create a Memo

1. You type your text in the browser
2. You set a password
3. Your browser computes a SHA-256 hash of the password (for authentication)
4. Your browser uses the raw password as an AES encryption key
5. Your browser encrypts the text with AES: AES.encrypt(plaintext, password)
6. The encrypted ciphertext and the password hash are sent to the server
7. The server stores the ciphertext and hash -- it never receives the plaintext or the raw password

When the Recipient Opens the Memo

1. They enter the password
2. Their browser computes the SHA-256 hash and sends it to the server
3. The server compares hashes -- if they match, it returns the encrypted ciphertext
4. The browser decrypts the ciphertext using the raw password: AES.decrypt(ciphertext, password)
5. The plaintext appears in the browser

At no point does the server have access to the readable content. The password serves double duty: authentication (via hash) and encryption (via raw value).

Step-by-Step: Encrypt Text with LOCK.PUB

1. Go to LOCK.PUB and select "Memo"
2. Paste or type your text -- anything from a single password to a multi-paragraph document
3. Set a strong password -- this is your encryption key, so make it good
4. Choose an expiration -- when should the encrypted memo self-destruct?
5. Copy the generated link and share it with your recipient
6. Share the password through a separate channel (phone call, different messaging app, in person)

The text is now AES-encrypted and accessible only to someone with both the link and the password.

Choosing a Strong Password

Since the password is your encryption key, its strength directly determines the security of your encrypted text.

Password Type	Example	Security Level
Common word	password123	Extremely weak
Personal info	john1990	Weak
Random short	kR7#mP	Moderate
Passphrase	correct-horse-battery-staple	Strong
Random long	4j&Km9!pQx2@Hn5v	Very strong

Best practice: use a passphrase -- three to five random words separated by dashes or spaces. Passphrases are easier to remember than random strings and harder to crack than short passwords.

When to Use Browser-Based Encryption

Sharing Passwords

Need to send a colleague their new account password? Encrypt it in a LOCK.PUB memo rather than sending it in plain text over Slack or email.

Sensitive Instructions

Medical dosage information, security alarm codes, safe combinations, server credentials -- anything you would not want a third party to read.

Legal or Financial Details

Bank account numbers, tax IDs, contract terms -- information that could cause harm if intercepted.

Personal Messages

Love letters, confessions, surprise plans -- sometimes privacy is about emotion, not just security.

Limitations to Know

Password Sharing Is Your Responsibility

AES encryption is only as secure as your password management. If you send the memo link and the password in the same email, you have effectively left the vault door open with the key taped to it.

Browser-Based Means Browser-Dependent

Client-side encryption relies on your browser's JavaScript engine. If your browser is compromised (by malware or a malicious extension), the encryption can be bypassed. Keep your browser updated and use trusted devices.

No Recovery Without the Password

If you forget the password, the text is gone. There is no "forgot password" option because the server does not have the key. This is a feature, not a bug -- but it means you need to remember or securely store the password.

Encrypt Without the Learning Curve

You do not need to understand cryptographic theory to protect your text. LOCK.PUB handles the AES-256 encryption in your browser, automatically, every time you create a memo. The server never sees your content. The math is battle-tested. All you need to provide is a good password.

Encrypt Text Now on LOCK.PUB -->