[ABOUT CRYPTFILE.ONLINE]

A free, personal project: file and text encryption that never leaves your browser.

CryptFile.Online is built and run by one person, Vladimir Lorentz, an independent developer based in Lyon, France. It is a personal project, not a company: there is no team, no investor and no account system — just a tool I wanted to exist and keep improving.

[WHY THIS SITE EXISTS]

Most "encrypt file online" services ask you to upload the very file you want to protect. That defeats the purpose: the moment the file reaches someone else's server, you are trusting their storage, their logs and their staff.

CryptFile.Online does the opposite. The encryption runs in your browser, on your device, using the Web Crypto API. The page is downloaded once; your files and passwords are never sent anywhere. You can check this yourself: open your browser's developer tools, switch to the Network tab and encrypt a file — no request carries its contents.

[HOW IT WORKS]

  • Algorithms. AES-256-GCM or ChaCha20-Poly1305, both authenticated: any change to an encrypted file is detected on decryption.
  • Passwords. Turned into a key with PBKDF2-SHA256 at 600,000 iterations, so guessing passwords is slow.
  • Large files. Read and encrypted in 2 MB chunks, so memory use stays flat whatever the file size.
  • Open format. Encrypted files use a documented .enc format, so they are not locked to this website.

[WHAT IT CANNOT DO]

Being honest about limits matters more than a long feature list:

  • It cannot recover a lost password or key. Nobody can — not me, not anyone. That is what makes the encryption worth using.
  • It cannot open files encrypted by other software — ransomware, DRM-protected video, WhatsApp backups or proprietary formats. The decryption guide explains how to identify what encrypted a file and where to go instead.
  • It does not replace full-disk encryption (BitLocker, FileVault) for protecting a whole device.

[HOW THE SITE IS FUNDED]

The tool is free and will stay free. Hosting is paid for by advertising (Google AdSense) and by visitors who choose to buy me a coffee. Ads never have access to your files: they run in the page like any other website's ads, while encryption happens locally on data that is never transmitted. See the privacy policy for exactly what is collected.

[GET IN TOUCH]

Bug reports, feature ideas and questions are welcome — see the contact page. You can also find me on LinkedIn.