LOC.1999

Small tools. No accounts. Nothing leaves your browser.

documents pdf · pages · convert · sheets · zip media images · video privacy inspect · lock · pgp · delete posts code count code · golf

Lock a file with a password

In this tab. The file you are protecting is never uploaded.

Every other “encrypt a file online” service asks you to upload the exact thing you were trying to keep private, encrypt it on their machine with a password you also gave them, and trust that they threw both away. This one has no endpoint. Turn off your wifi after the page loads and it still works.

It writes a standard file, not a format of our own.

The obvious way to build this is our own container — a header, a salt, a block of ciphertext. It would work, and it would be a trap: the person you send the file to could only open it by coming back to this page, and if this page is gone in five years so is their file.

So the output is OpenPGP, the format gpg has written since 1997. Anyone can open it with gpg -d yourfile.gpg, or with Kleopatra on Windows or GPG Suite on a Mac, whether or not they have ever heard of this site. Nothing here is a lock only we hold the key to.

1. Choose a file

Drop a file here, or click to choose Any kind, any size your browser can hold — nothing is uploaded

2. Choose a password

Password

Again

There is no way to recover this. No reset link, no support address, no copy of the password anywhere. That is the point of it, and it means a forgotten password is a lost file. Write it down somewhere real before you send the file anywhere.

3. Lock it

As text, not bytes — a bit larger, but survives being pasted into an email.

Is this actually private?

The honest notes

Nothing is uploaded. Static page, no endpoint, no account. Neither the file nor the password leaves the tab, and there is nowhere for them to go.
The output is OpenPGP, symmetric mode. The same thing gpg --symmetric produces: your password is stretched into a key, a random session key encrypts the data, and the result is a file any OpenPGP implementation can read. AES-256 with an authenticated mode, which means a file that has been tampered with fails to open rather than decrypting into something subtly wrong.
The password is the whole of the security. There is no key file, no second factor and no server-side rate limit — an attacker with the file can guess at it as fast as their hardware allows. That is why the meter above is pessimistic and why a suggested passphrase is worth taking. Eight words from the list is 64 bits, which nobody is guessing. The list is published on this page, so those are its real bits — not the flattering number you get by counting the letters.
There is no recovery. Nothing here stores the password, so nothing here can help you if it is forgotten. This is not a policy that could be relaxed; it is what the encryption is.
The filename is kept inside the file, not on it. Locking report.pdf gives report.pdf.gpg, and unlocking gives report.pdf back even if somebody renamed the locked file on the way. The name is inside the encryption, so a person who intercepts it does not learn what you sent.
The size still shows. Encryption hides the contents, not the fact that you sent a four megabyte file to someone. If that matters, padding it is on you.
It downloads about 390 KB the first time: OpenPGP.js, served from this domain. It is the one library here that exists because writing it ourselves would be reckless — a cipher that is subtly wrong looks exactly like one that is right, and nobody holding the file could tell.
Everything is in memory. A very large file will run a tab out of memory. There is no streaming mode here yet.

LOC.1999

Lock a file with a password

1. Choose a file

2. Choose a password

3. Lock it

1. Choose the locked file

2. The password

3. Unlock it

Is this actually private?

The honest notes