Encrypt a file, without uploading it

How to encrypt a file

1. Drop the file you want to protect into the box above and pick Encrypt.
2. Enter a strong passphrase (and confirm it), then click Encrypt file.
3. Download the .morphrenc file. To get the original back, drop it in, choose Decrypt, and enter the same passphrase.

Why encrypt locally

Emailing a sensitive document or storing it in the cloud means trusting someone else with it. Encrypting it first means only someone with your passphrase can ever read it, and because Morphr encrypts on your own device, the unprotected file is never uploaded anywhere. Lose the passphrase, though, and the file is gone for good: there is no backdoor.

How the encryption works

Your passphrase is stretched into a 256-bit key with PBKDF2 (SHA-256, 210,000 iterations) and a random salt, then used to encrypt the file with AES-256-GCM and a random nonce. GCM also authenticates the data, so any tampering, or a wrong passphrase, is detected and rejected rather than producing a corrupted file.

Exactly what happens to your file

Your passphrase is never used directly as an encryption key. It's first stretched into a 256-bit key using PBKDF2 with SHA-256 and 210,000 iterations, combined with a fresh random 16-byte salt generated for that file. The iteration count is high specifically to make brute-forcing a weak passphrase by trying millions of guesses meaningfully slower and more expensive for an attacker. That derived key then encrypts your file with AES-256-GCM, using a fresh random 12-byte nonce. GCM is an authenticated mode: alongside the ciphertext it produces a 16-byte tag that lets decryption detect, with certainty, whether the ciphertext or a wrong passphrase has been used — a mismatch fails loudly with an error rather than silently handing back corrupted data.

What the encrypted file quietly reveals, and what it hides

The output is a self-describing container (Morphr's own ".morphrenc" format) that stores everything decryption will later need (the PBKDF2 iteration count, the salt, the nonce, and your original filename) in a header ahead of the encrypted bytes. That header is authenticated by the same GCM tag, so it can't be tampered with undetected, but it is not itself encrypted: anyone holding the .morphrenc file can read your original filename and see roughly how large the plaintext was, even without the passphrase. What they cannot get, without the passphrase, is a single byte of the actual content.

What this protects against, and what it flatly does not

This is real protection against anyone who might see the file in transit or at rest without your passphrase, such as a cloud storage provider, an email server, or someone who intercepts a shared link. It is not protection against a forgotten passphrase: there is no recovery mechanism, no backdoor, and no "reset" option built in anywhere, by design. A lost passphrase means the file is permanently unreadable, so keep the passphrase somewhere as durable as the file itself. It also doesn't hide that an encrypted file exists, when it was created, or (as above) its name and approximate size. The only thing it hides is the content itself.

Sharing a passphrase safely

210,000 PBKDF2 iterations raises the cost of guessing, but it doesn't rescue a genuinely weak passphrase — a short dictionary word or a reused password is still crackable offline once someone has your .morphrenc file, since the salt and iteration count needed to attempt it are sitting right there in the header. Use a long, unique passphrase you wouldn't reuse elsewhere. Several random words or a password manager's generator both work well. Then send it somewhere the file itself isn't: a phone call, a separate messaging thread, or a password manager's sharing feature. Putting the passphrase in the same email as the attachment defeats the whole point, since anyone who intercepts one gets the other too.

How this differs from the PDF tool's "Protect" mode

The /pdf tool also offers AES-256 password protection, but it's a different mechanism suited to a different job: it uses the PDF format's own encryption scheme, with a separate owner and user password as defined by the PDF spec, so the result is still an ordinary .pdf file that opens in any standard PDF reader once the password is entered. This /encrypt tool works on any file type at all, but the output is a Morphr-specific .morphrenc container — recognized and reversible here, but not something a PDF reader, image viewer, or any other application will open directly.