1. Derive a key on this device
The browser draws a 16-byte salt per file with Web Crypto, then runs PBKDF2-HMAC-SHA256 for 100,000 iterations to get an AES-256 key. The passphrase does not leave this tab.
FILEBOX
Encrypt a file online with AES-256 — locally in your browser
No account. Encrypt a document, export, or config in this tab with chunked AES-256-GCM, then download the ciphertext. One file up to 5 GB. The file and passphrase are never uploaded.
✓ AES-256-GCM
✓ 5 GB per file
✓ .lock / .enc
✓ No account
01
Pick a file and encrypt it on this device
Choose a file or text, then enter a passphrase only you keep. Encryption stays on this device. Save the .lock or .enc yourself when it finishes.
Drop a file, or click to choose
Any type · 5 GB max per file
The passphrase is derived with PBKDF2 (100,000 rounds, SHA-256). Each file uses its own salt.
PBKDF2-HMAC-SHA256 · 100,000 iterations
Up to 1,000 items at once, 10 KB per line.
The encrypted result downloads only to this device. Save the .lock / .enc yourself, and keep the passphrase in a password manager—not next to the file.
0%
Download name
Confirm the browser saved the file. A forgotten passphrase cannot be recovered.
02
How AES-256 file encryption works in the browser
The server does not take part. The browser reads the file in chunks, derives a key from your passphrase, and writes a .lock with a header.
2. Encrypt in 1 MB chunks
Plaintext is read in chunks. Each chunk gets its own 12-byte IV and is written as IV + ciphertext + 16-byte tag. Files over 5 GB are rejected so the whole file is not loaded into memory at once.
3. Decrypt restores the file name
Drop a .lock or .enc back in. The header yields the original name and MIME, then each chunk’s tag is checked. A wrong passphrase or a tampered file will not emit partial plaintext.
03
Algorithm, file format, and recovery limits
File Encryption Box answers how to seal a whole file on this device. Algorithm, format, size limits, and what it cannot recover are written below.
Uses AES-256-GCM. Passphrase derivation is PBKDF2-HMAC-SHA256, 100,000 rounds. Compute runs through the browser Web Crypto API.
Files are MakePwd Lock v1: magic CSLK, then version, salt, chunk size, and an optional original name. Text mode is Base64 (passphrase: salt ‖ IV ‖ ciphertext ‖ tag).
One file up to 5 GB, 1 MB per chunk by default. Text mode allows 1,000 lines, 10 KB each. Short secrets fit Burn-Link better than a whole-file flow.
A forgotten passphrase cannot be recovered, and there is no cloud copy. This is not a drive, and it does not stop someone from redistributing a decrypted file. Keep the passphrase apart from the ciphertext.
FAQ
File encryption FAQ
On this page, no. Encrypt and decrypt finish in this tab with Web Crypto. The file, passphrase, and plaintext are never uploaded and are not written to analytics.
AES-256-GCM. The passphrase is derived with PBKDF2-HMAC-SHA256 and 100,000 iterations. Each file gets its own salt. One file can be up to 5 GB, streamed in 1 MB chunks. Output is .lock (preferred) or .enc, same binary format.
No. There is no server-side plaintext or passphrase backup. Use a long enough passphrase and store it in your own password manager. You can create a new one with the password generator on this device.
Send the .lock or .enc through a drive or email, and send the passphrase on a different channel. Burn-Link is a one-time link for short text. This page is for local backups of whole files. The file is not sent to MakePwd servers.
Passwords, short secrets, and outbound text can stay local too
Seal a whole file on this page. Shorter content does not need to become a file first.
Password Generator
Create a 6–128 character random password for the encryption passphrase. Plaintext is not uploaded, and there is no password vault.
Burn-Link
To send only a passphrase or recovery code, make a one-time link. The key stays in the URL # fragment.
Privacy Cleaner
Before you send a note, strip tracking parameters and mask phone numbers and ID numbers.