Security and Data Handling

How to use these tools safely

Treat production passwords, private keys, tokens, regulated data, and customer information as sensitive. Use an approved workflow when material must remain under organizational control, and test encryption and decryption together before sharing a result.

What the site does

Encrypt Online is a collection of focused tools for encryption, encoding, hashing, certificates, tokens, and structured data. Many tools perform their main transformation in the page. The site is a static application, so ordinary tool inputs stay in the page rather than being stored by an Encrypt Online application server. Some workflows can contact a remote target when the page explicitly supports a URL, endpoint, or remote document.

Third-party code and advertising

Google Analytics and Google AdSense are loaded sitewide, including on tool pages, unless blocked by a browser or network control. Their scripts run in the same page context as the tool interface and may create network requests, cookies, or other measurement and advertising activity. Third-party scripts and browser extensions run alongside the tools. Use a device and browser you trust, and keep production secrets in your approved tools.

See the Privacy Policy for the operational disclosure of analytics, advertising, hosting, cookies, and messages sent through the contact page.

Checking your results

• Check that the algorithm, format and settings match the application that will use the result. An algorithm label is not a certification of the application.
• A signature check uses the key you provide. Confirm where that key came from. For certificates, also check revocation, hostname coverage and the trusted roots used by your client.
• A pasted header or configuration file describes one response or setup. Test the other pages and responses your users rely on.
• Results depend on the input, implementation, browser, and selected settings. Review critical output independently.

Text encryption formats

New output from the main Encrypt Tool, Protect Text, Encrypt Link, and Encrypt Tweet uses a versioned EOE1 password-based AES-GCM envelope. Their matching decrypt workflows recognize that prefix and check the authentication tag before returning text. Older unprefixed CryptoJS AES-256-CBC and 3DES values remain available through explicit legacy compatibility choices because Base64 alone provides too little information to identify the original algorithm reliably.

The OpenPGP Message workflow uses pasted recipient keys and is separate from the shared passphrase tools. Compare the full key fingerprint through a trusted channel to establish ownership.

PDF password profile

Encrypt PDF creates PDF 1.7 output with AES-128 and Standard Security Handler V=4/R=4. The route verifies those markers before download. For revision 6 AES-256 output, use the documented local qpdf example. PDF permission flags are reader-enforced preferences; recipient access controls belong in the sharing system.

Tools that contact another host

A remote-request tool identifies that behavior near its action. JWKS Fetch and Website Availability Check send a direct HTTPS request from the browser, so the destination receives the user's IP address and browser request headers. Those requests omit credentials and referrer data and block redirects. The destination can still observe the request and source IP address.

Dependencies and release review

The site is delivered as a static application and depends on its build, browser, hosting, analytics, advertising, and other page dependencies. Changes should be reviewed for both functional correctness and copy accuracy. This page describes the current operating model; formal assurance would require an independent audit or certification.

Selected substantive changes are recorded in the Product and Security Changelog.

Reporting

To report a security issue, privacy concern, or incorrect technical claim, use the Contact page. Include the affected route, a short reproduction, and the minimum non-sensitive detail needed to investigate. Keep passwords, private keys, tokens, and other live secrets in their protected environment.

Machine-readable reporting details are published at /.well-known/security.txt. Authorization for security testing remains limited to permission already granted by the system owner.