Skip to developer tool
DEVELOPER TOOLKIT SECURITY & ENCODING

Local File Encryption & Decryption

Protect a local file with a password, or restore an encrypted file. Everything runs in your browser.

No uploads · No account · Password protected

Open workspace Read the guide
BUILT FOR THE DETAILS
  1. 01Add your input
  2. 02Choose a password
  3. 03Download your file
Explore all developer tools

Protect your file

Local processing · AES-256-GCM

Any file type, up to 50 MiB.

For encryption, use a unique passphrase of at least 12 characters. Save it separately: a lost password cannot be recovered.

Files and passwords are processed on this device, without uploads or browser storage. Download your result before leaving. Your original file is never overwritten or deleted.

How to encrypt and decrypt a local file

  1. Choose Encrypt a file, select a file up to 50 MiB and enter the same strong password twice.
  2. Encrypt, then download the .pkenc file. Keep the password separately from the encrypted file.
  3. To restore the file, choose Decrypt a .pkenc file, select your downloaded file and enter the original password. Download the restored file after verification succeeds.

What is protected?

AES-256-GCM encrypts the original file bytes, filename and file type, and verifies integrity before releasing a restored file. A new random salt and nonce are generated for every encryption. Password keys use PBKDF2-SHA-256 with 600,000 iterations. The downloaded encrypted file has a generic name; its size is still visible.

Formats and limits

This tool creates PixelOkay .pkenc format v1 files. Decryption supports files created by this tool; it does not unlock ZIP archives, PDFs, GPG or other encryption formats. Files are processed in memory with a 50 MiB source limit. Use a modern browser on HTTPS or localhost. Passwords are used exactly as entered, including spaces and letter case.

Reference: Web Crypto encryption API.

Frequently asked questions

Do my files leave my device?

No. File contents and passwords are only used locally by JavaScript and the browser's Web Crypto API. No encryption server or third-party library is required.

Can I recover a forgotten password?

No. There is no password reset or recovery key. Save your password securely and verify that you can decrypt your download before relying on it.

Why did decryption fail?

An incorrect password and a damaged or modified file both fail the integrity check. You must use the exact password and an intact .pkenc file created by this tool.

Does encryption change my original file?

No. This tool creates a separate download. It does not change or securely erase the original file.

Continue your workflow

Random Password GeneratorChecksum CalculatorSHA Hash Generator

A separate encrypted copy in this tool’s format

Choose encryption or decryption and the corresponding local input. Download the output separately and retain the original until you have reviewed the result.

Scope of this workflow

Decryption supports this tool’s .pkenc format, not arbitrary archives or PDF encryption. There is no password recovery and no secure erasure of the original.

File Checksum Calculator — SHA-256 & SHA-512 · All developer tools · Privacy policy · Contact PixelOkay