Handing a sensitive file to an online tool usually means handing it to that tool's server first. For a PDF converter that's an annoyance. For a private key, a certificate request or an encrypted backup, it's a real problem.
We built the Encryption & Keys category on Utility Tools Lab around the opposite assumption: the work should happen in your browser, using the Web Crypto API, and nothing should be transmitted. It has 7 free tools. Here's what each does and how it's built.
Encrypt files and text
AES File Encryptor
Encrypt or decrypt any file with a passphrase using AES-256-GCM, entirely in your browser. The key is derived from your passphrase with PBKDF2, run 250,000 times over. Encryption uses AES-GCM, which is authenticated, so a wrong passphrase produces a clear failure rather than silently garbled bytes.
AES Text Encryptor
The same AES-256-GCM and PBKDF2 approach for text strings. The output is a portable Base64 string, so you can paste it into a note, a chat or a config file and decrypt it later with the same passphrase.
Generate key pairs
RSA Key Generator
Generate RSA key pairs at 2048, 3072 or 4096 bits, for encryption (OAEP) or signing (PSS), in PEM format. Download or copy instantly.
ECDSA Key Generator
Generate ECDSA or ECDH key pairs on P-256, P-384 or P-521, in PEM or JWK format. The private key is blurred by default.
Between them these two cover the main asymmetric families: RSA for legacy compatibility, and elliptic curves for modern TLS, JWT and code-signing work. Both draw their randomness from crypto.getRandomValues, and neither transmits anything.
Work with certificates
CSR Generator
Generate a PKCS#10 certificate signing request and its matching private key in your browser. It supports RSA 2048/4096 and EC P-256/P-384. Nothing is uploaded or transmitted, which matters because the private key never has to leave your machine on its way to a certificate authority.
Cert Decoder
Paste a PEM certificate and read its subject, issuer, validity dates, SANs, key algorithm and SHA-256 fingerprint. Decoding happens in your browser only. It's handy when you're debugging an expired or mismatched cert and just want to see what's inside.
A classic for learning
Text Cipher
Caesar, ROT13, Atbash and Vigenère ciphers, with an adjustable shift, a custom keyword and an instant swap. These are for puzzles, teaching and CTF warm-ups. They are not secure, so don't use them to protect anything real. For that, use the AES tools above.
Why a browser is a reasonable place to do this
- No server to trust. Your passphrase, plaintext and private keys stay in the tab.
- Standard primitives. The Web Crypto API is built into modern browsers, so these tools use the platform's own cryptography rather than a hand-rolled implementation.
- Fast feedback. There's no upload or queue, so generating a key pair or decoding a certificate takes seconds.
Limits worth knowing
Browser-based crypto is convenient, but it's not a substitute for everything:
- Your passphrase is the weak point. PBKDF2 at 250,000 iterations slows down guessing, but a short or reused passphrase is still weak. Use a long, unique one.
- There's no recovery. If you lose the passphrase for an encrypted file, the file is gone. Authenticated encryption can't be "unlocked" without the key.
- Treat generated private keys like any other secret. Store them in a password manager or secrets vault, and think carefully before generating production keys on any machine you don't fully control.
- For high-stakes or regulated work, use audited, well-established tooling (for example, OpenSSL, GnuPG or your platform's key management service) and follow your organization's policy.
Try them out
Browse the full Encryption & Keys category. If you spot a bug or want another tool added, such as hashing or JWT utilities, tell us in the comments.
Do you generate keys and CSRs locally, in the browser, or in a managed service? I'd like to hear what your workflow looks like.
Top comments (0)