🔒 Lock — encrypt files with a passphrase

Drop files here, click to choose, or paste (Ctrl/⌘+V) files or a screenshot

Passphrase

Again

ZIP — AES-256 Strong, and the other person just needs 7-Zip, WinRAR, or Keka. The right default for sending to people. age The modern sealed format (scrypt + ChaCha20-Poly1305). Opens with the free age tool anywhere — the strongest choice for your own backups. OpenSSL AES-256-CBC, opens with one openssl command on any Mac or Linux box. No tamper protection — fine between trusted machines. ZIP — legacy (weak) Opens everywhere, even Windows Explorer — but ZipCrypto is 1990s crypto and can be cracked. Only for keeping honest people out.

🗝 Unlock — decrypt a locked file

Drop an encrypted file here, or click to choose

Passphrase

Encryption that other software can actually open

Most "encrypt a file online" pages either upload your file to a server (read that again) or invent their own format that only that page can ever open. Lock Box does neither: everything runs in your browser, and every format it writes has a real ecosystem on the other side —

Format	Cipher	The other side opens it with
ZIP — AES-256	AES-256-CTR + HMAC-SHA1, PBKDF2	7-Zip, WinRAR, Keka, most unzip apps
age	ChaCha20-Poly1305, scrypt	`age -d file.age` (free, all platforms)
OpenSSL	AES-256-CBC, PBKDF2	`openssl enc -d -aes-256-cbc -pbkdf2 -in file.enc -out file`
ZIP — legacy	ZipCrypto (weak!)	Everything, including Windows Explorer

And it works both ways: drop in a password-protected ZIP someone sent you, an .age file (binary or armored), or an OpenSSL Salted__ file (modern PBKDF2 or the old MD5 key derivation) and Lock Box detects the format and opens it. Multiple files chosen with age or OpenSSL are bundled into a ZIP first, since those formats seal exactly one file.

Honest words about strength

The lock is only as good as the passphrase. Use a long one — Key Cutter will cut you a diceware passphrase that's strong and memorable.
Legacy ZIP is weak. ZipCrypto can be broken by attack tools regardless of your passphrase. It's here because sometimes "opens on any computer in the building" matters more than the lock — just know which one you picked.
The OpenSSL format authenticates nothing: a tampered file decrypts to garbage without warning. ZIP-AES and age both detect tampering.
GPG files aren't supported — the OpenPGP format is a labyrinth of variants. For modern sealed files, use age.
Encrypting doesn't hide the file size, and ZIP formats don't hide file names either. age and OpenSSL hide the name (the file inside is just bytes).

What's under the hood

The AES-CTR, ChaCha20, Poly1305, scrypt, and MD5 cores are hand-written below — view-source and you're reading them — with the standard test vectors from the RFCs runnable in your own browser console (lockboxSelfTest()). AES-CBC, PBKDF2, HKDF, HMAC, and the SHA family come from your browser's own WebCrypto. Passphrases are never stored; there is no telemetry; the page works with the internet off.

Part of K-Engine Local Tools — free, privacy-respecting utilities that run on your device. MIT licensed, from the K-Engine workshop · download the source.