How this encryption works — and how to verify it
When you click Encrypt, the tool generates a random 16-byte salt and a random 12-byte IV with crypto.getRandomValues(), stretches your password into a 256-bit key with PBKDF2-SHA-256 at 310,000 iterations, and encrypts your text with AES-256-GCM. The salt, IV and ciphertext are packed together, Base64-encoded and prefixed with LRLY1. so the tool can recognize its own output. Nothing about this is proprietary — the exact byte layout is documented below so you (or anyone you send the text to) can decrypt it independently with a few lines of Python, Node.js or any language with standard crypto libraries:
| Part | Bytes | What it is |
|---|---|---|
| Prefix | — | The literal string LRLY1. (format marker, version 1). Everything after it is standard Base64. |
| Salt | 0–15 | Random 16-byte PBKDF2 salt — makes every encryption unique and defeats precomputed (rainbow-table) attacks. |
| IV | 16–27 | Random 12-byte AES-GCM initialization vector, freshly generated each time. |
| Ciphertext + tag | 28+ | AES-256-GCM ciphertext of the UTF-8 plaintext, with the 16-byte authentication tag appended (as Web Crypto outputs it). |
Key derivation: PBKDF2 with SHA-256, 310,000 iterations, 256-bit output. To decrypt elsewhere: strip the prefix, Base64-decode, split at bytes 16 and 28, derive the key, run AES-256-GCM.
Why AES-256-GCM and PBKDF2?
AES-256-GCM is authenticated encryption: alongside scrambling the text, it computes a cryptographic tag over the ciphertext. On decryption the tag is verified first — if even one bit was altered, truncated or tampered with, decryption fails cleanly instead of returning corrupted or attacker-modified text. PBKDF2 addresses the other weak point: passwords. Running the password through 310,000 rounds of SHA-256 makes each guess in a brute-force attack hundreds of thousands of times more expensive, while costing you only a fraction of a second once.
What this protects — and what it doesn't
An honest threat model: this tool protects the content of your message at rest and in transit — you can store the encrypted string in notes, email it, or paste it into a chat, and without the password it is unreadable. It does not hide the fact that a message exists, roughly how long it is (ciphertext length tracks plaintext length), or who you sent it to. And the encryption is only as strong as the password: AES-256 itself is unbreakable in practice, so attackers go after weak passwords instead. Use a long random one from the password generator, or check the one you have with the password strength checker.
Frequently asked questions
- Is my text or password uploaded to a server?
- No. Everything runs locally in your browser using the built-in Web Crypto API — the same cryptography engine your browser uses for HTTPS. There is no upload, no server-side processing, no analytics on your input and no storage: close the tab and nothing remains. You can even load the page, disconnect from the internet and keep encrypting.
- What encryption does this tool use?
- AES-256 in GCM mode (authenticated encryption), with the key derived from your password using PBKDF2-SHA-256 at 310,000 iterations and a random 16-byte salt. A fresh random 12-byte IV is generated for every encryption, so encrypting the same text twice produces different output. These are the same primitives recommended by NIST and OWASP.
- Can larely (or anyone) recover my text if I lose the password?
- No. There is no backdoor, no master key and no account recovery — by design, nobody but a person holding the password can decrypt the output. If you lose the password, the encrypted text is unrecoverable. Store the password somewhere safe, such as a password manager.
- Can I decrypt the output outside this site?
- Yes. The format is fully documented on this page: strip the LRLY1. prefix, Base64-decode the rest, take bytes 0–15 as the PBKDF2 salt, bytes 16–27 as the AES-GCM IV, and the remainder as ciphertext plus tag. Derive the key with PBKDF2-SHA-256 at 310,000 iterations and decrypt with AES-256-GCM — a few lines in Python, Node.js or any language with standard crypto libraries.
- Is AES-256 actually secure?
- Yes. AES-256 is the symmetric cipher approved by NIST for protecting classified information, and no practical attack against it exists — brute-forcing a 256-bit key is physically infeasible. In practice the weak point is never the cipher but the password: a short or guessable password can be brute-forced regardless of how strong the encryption is, so use a long random one.
- Why does decryption fail?
- Three common reasons: the password is not exactly the same one used to encrypt (it is case-sensitive, and a stray space counts); the encrypted text was altered, truncated or had characters lost in copy-paste — GCM detects any change and refuses to decrypt rather than return garbage; or the text was not produced by this tool, in which case the LRLY1. prefix check fails. Re-copy the full encrypted string and re-type the password carefully.