[IS IT SAFE TO ENCRYPT FILES ONLINE?]
It depends entirely on where the encryption happens. Here is how to check.
"Online" covers two very different things. Some tools upload your file to their server and encrypt it there — so the operator sees the file and the password. Others, including this one, run the encryption inside your browser, and the file never leaves your device. The first kind asks for your trust; the second can be checked.
Here are five things to check before you trust any online tool with a sensitive file, this one included.
[1. DOES THE FILE LEAVE YOUR DEVICE?]
Open your browser's developer tools (F12), go to the Network tab, and encrypt a test file. A tool that uploads it shows a request roughly the size of the file. A client-side tool shows none.
A quicker test: load the page, switch off Wi-Fi, and encrypt a file. If it still works, the encryption is happening on your device.
[2. DOES IT USE STANDARD, AUTHENTICATED ENCRYPTION?]
Look for named, standard algorithms — AES-256-GCM, ChaCha20-Poly1305 — rather than "military-grade proprietary encryption". "Authenticated" (GCM, Poly1305, or a separate HMAC) means tampering is detected rather than producing silently corrupted output.
[3. HOW IS THE PASSWORD TURNED INTO A KEY?]
Passwords are short; keys are 256 bits. A good tool stretches the password with a deliberately slow function — PBKDF2 with hundreds of thousands of iterations, scrypt or Argon2 — so that each guess costs an attacker real time. A tool that does not say how it derives the key probably does not do it well.
[4. CAN YOU GET YOUR FILES BACK WITHOUT THE WEBSITE?]
If the site disappears, can your files still be decrypted? Prefer tools whose file format is documented, so that someone could write a decrypter from the specification. This site publishes its .enc format byte by byte for that reason.
[5. WHO RUNS IT?]
A tool with a named person or company behind it, a privacy policy and a contact address has something to lose. An anonymous page that asks for payment to "unlock" a file is a warning sign. This site is a personal project by an independent developer, and says so.
[THE HONEST LIMITATION OF EVERY BROWSER TOOL]
A web page's code is downloaded each time you visit. Even a tool that is client-side today could, in principle, be changed tomorrow — by its author or by someone who compromised the site. You are trusting the site each time you use it, not once.
For most files that risk is small, and the convenience is worth it. For files where a leak would be catastrophic — or if you encrypt the same kind of data every day — use an installed open-source tool such as 7-Zip, VeraCrypt or GnuPG, whose code does not change under you.
[FREQUENTLY ASKED QUESTIONS]
Does CryptFile.Online upload my files?
No. Encryption and decryption run in your browser with the Web Crypto API. You can confirm it in the Network tab of your browser's developer tools, or by going offline after the page loads.
Is client-side encryption as strong as desktop software?
The cryptography is the same: browsers implement AES-GCM and PBKDF2 natively. The difference is trust in the code delivery, explained above, not the strength of the encryption.
Can the website operator see my password?
Not with a client-side tool: the password is used in your browser to derive the key and is never transmitted. With a tool that uploads files, assume the operator can see both.