Security and Data Handling

How to use these tools safely

Treat production passwords, private keys, tokens, regulated data, and customer information as sensitive. Use an approved workflow when material must remain under organizational control, and test encryption and decryption together before sharing a result.

What the site does

Encrypt Online is a collection of focused tools for encryption, encoding, hashing, certificates, tokens, and structured data. Many tools perform their main transformation in the page, and the site does not operate an application server intended to receive or store ordinary tool inputs. Some workflows can contact a remote target when the page explicitly supports a URL, endpoint, or remote document.

Third-party code and advertising

Google Analytics and Google AdSense are loaded sitewide, including on tool pages, unless blocked by a browser or network control. Their scripts run in the same page context as the tool interface and may create network requests, cookies, or other measurement and advertising activity. Microsoft Clarity is not used. Do not interpret a page-side transformation as a guarantee that third-party code, browser extensions, or a compromised device cannot observe page content.

See the Privacy Policy for the operational disclosure of analytics, advertising, hosting, cookies, and messages sent through the contact page.

What tool results do and do not prove

• Algorithm names, formats, and parameter labels describe the selected workflow; they do not certify a system design.
• A successful signature or certificate inspection does not establish trust, revocation status, hostname policy, or authorization.
• A security-header or configuration snapshot is not proof that the live deployment is secure.
• Results depend on the input, implementation, browser, and selected settings. Review critical output independently.

Text encryption formats

New output from the main Encrypt Tool, Protect Text, Encrypt Link, and Encrypt Tweet uses a versioned EOE1 password-based AES-GCM envelope. Their matching decrypt workflows recognize that prefix and check the authentication tag before returning text. Older unprefixed CryptoJS AES-256-CBC and 3DES values remain available through explicit legacy compatibility choices because their algorithm cannot be identified reliably from Base64 alone.

The OpenPGP Message workflow uses pasted recipient keys and is separate from the shared passphrase tools. Reading or using a key does not prove who owns it; compare its fingerprint through a trusted channel.

PDF password profile

Encrypt PDF creates PDF 1.7 output with AES-128 and Standard Security Handler V=4/R=4. The route verifies those markers before download. It does not advertise AES-256; the local qpdf example is the recommended path when revision 6 AES-256 output is required. PDF permission flags are enforced by readers and are not access-control guarantees.

Tools that contact another host

A remote-request tool identifies that behavior near its action. JWKS Fetch and Website Availability Check send a direct HTTPS request from the browser, so the destination receives the user's IP address and browser request headers. Those requests omit credentials and referrer data and block redirects, but they are not anonymous.

Dependencies and release review

The site is delivered as a static application and depends on its build, browser, hosting, analytics, advertising, and other page dependencies. Changes should be reviewed for both functional correctness and copy accuracy. This page is a disclosure of the current operating model, not a third-party audit or a security certification.

Selected substantive changes are recorded in the Product and Security Changelog.

Reporting

To report a security issue, privacy concern, or incorrect technical claim, use the Contact page. Do not include passwords, private keys, tokens, or other live secrets in a report. Include the affected route, a short reproduction, and the minimum non-sensitive detail needed to investigate.

Machine-readable reporting details are published at /.well-known/security.txt. Publishing that file does not grant permission to access data, disrupt service, or test systems beyond authorization you already have.