File · Encryptor

How to encrypt a file (free)

1. Keep encrypt selected and drop in any file.
2. Enter a strong passphrase and confirm it.
3. Click encrypt & download — you get a .kenc file.
4. To reverse it, switch to decrypt, drop the .kenc file, enter the same passphrase.

How it works

Your passphrase is stretched into a 256-bit key using PBKDF2-HMAC-SHA-256 with 600,000 iterations and a random 16-byte salt. The file is then encrypted with AES-256-GCM using a fresh random 12-byte nonce. GCM is authenticated encryption: if the file or passphrase is wrong, decryption fails cleanly instead of returning corrupted data. Everything uses the browser's built-in Web Crypto API — no libraries, no servers.

The .kenc file format

Each encrypted file starts with a small header — magic bytes KENC, a version, the PBKDF2 iteration count, the salt and the nonce — followed by the AES-GCM ciphertext and its authentication tag. The header holds no secrets; without your passphrase it reveals nothing about the contents.

Is my data private?

Yes. The file is read and encrypted entirely in your tab using Web Crypto. Nothing is uploaded — you can verify in the network tab, and it works offline once loaded. We never see your file or your passphrase.

How big a file can I encrypt?

Files are processed in memory in one pass, so very large files may be slow or hit your browser's limits. Files above ~100 MB show a warning; above 1 GB are refused. For everyday documents, photos and archives it's instant.