AES File Encryption & Decryption

A recoverable package, not a renamed file

The file workflow uses AES-256-GCM and the same password derivation as text encryption. Before encryption, the original filename, MIME hint and byte length are placed in an internal record with the file bytes. That record is encrypted together; the public package does not expose the original filename.

Download writes encrypted.aes.json. Changing an extension does not encrypt a file, and copying only the ciphertext field loses the recovery metadata. Keep the downloaded package and your password separately. This is this site's versioned protocol, not a format that claims to open ZIP passwords, office document encryption or an arbitrary .aes file.

Encrypt, save and restore

1. Choose Encrypt, select or drop one original file, and enter a password. Zero-byte files are supported.
2. Run the operation. Processing occurs in a Worker; a busy state is shown instead of invented progress percentages.
3. Download the complete package and keep a separate original until you have verified recovery.
4. Choose Decrypt, import the package and enter the password. Download the restored file and verify its bytes before deleting any original.

Cancellation terminates the active Worker. Reselecting invalidates the old result; an older job must not replace a new selection. Clearing releases application references, but JavaScript memory cleanup is not a physical secure-erasure guarantee.

Limits and safe recovery

The original-file limit is 25 MiB. Encrypted JSON grows because Base64 needs roughly four characters for every three bytes, so package import is capped at 36 MiB. Web Crypto processes the message as a whole; this is not native streaming encryption and may use several copies in memory. Large mobile jobs can take longer.

The file page deliberately uses password-based GCM only. On recovery, filenames are sanitized to remove path separators and dangerous characters, and downloads use a generic binary MIME type. Authenticated recovery does not make the original file safe to execute. Do not import a package from an untrusted source expecting the tool to inspect its content for malware.

Related tools and reading

• Encrypt text
• Decrypt text
• Generate a key
• What Is AES Encryption? Keys, Blocks and Recovery
• AES-GCM vs CBC vs CTR: Authentication and Parameters
• AES-128 vs AES-192 vs AES-256: Bytes and Encodings

Technical references

• NIST FIPS 197 — AES
• MDN — AES-GCM
• MDN — AES-CTR

Updated October 16, 2026