Hex Watch Cipher SECURE WORKSPACE

Protect messages with modern encryption. Encryption and decryption run locally in your browser.

Compose a secure message

Choose a cipher, set your access key, then encrypt or decrypt.

Encryption method Authenticated encryption with a random salt and IV for each message.

AES-GCM key size This selects the derived AES key size, not the number of characters in your passphrase. Keep using a long, unique passphrase; Unicode characters do not equal bytes. The encrypted token records its key size and decrypts automatically.

Access key

Required access-key length for new encryption

Access-key quality Add an access key to see an estimate.

Enter 24 characters for new password-based encryption.

Use a long, unique passphrase. You can type one or generate it securely.

Exactly 24 characters
Lowercase
Uppercase
Symbols (for example, ! @ #)
Numbers

This is a rough estimate, not a password audit. It considers length, character variety, repetition, and common sequences. Character groups are guidance, not a password requirement; the selected length is enforced for new password-based encryption.

New AES-GCM, CBC-HMAC, RSA-OAEP + AES-GCM, and file encryption require exactly the selected number of Unicode code points (characters). Decryption is not subject to this selected-length rule. Choose a long, unique passphrase; a randomly generated one is preferable to a predictable password. Maximum 4,096 UTF-8 bytes.

Digital signatures · optional sender verification

Sign an encrypted token with ECDSA P-256, or verify a signed token before decrypting. A signature proves which key signed the token, not who owns that key. Compare the public-key fingerprint through a trusted channel.

Sign encrypted output Generated signing-key handling The private key stays in page memory and is cleared when the workspace locks or the page closes. It cannot be recovered unless you import a backup. ECDSA P-256 public signing key (SPKI PEM)

SHA-256 signing-key fingerprint: Not calculated

Private signing key (PKCS#8 PEM) Private keys can sign messages as you. Keep backups secret and share only the public key.

Message or encrypted token Messages are limited to 100,000 UTF-8 bytes; encrypted tokens to 140,000 characters and signed tokens to 200,000. Keyboard shortcut: Ctrl/⌘ + Enter to encrypt; add Shift to decrypt.

Encrypt a file

Files always use AES-256-GCM, regardless of the selected text cipher.

File to encrypt or decrypt (up to 1 GiB) Maximum 1 GiB. Files use chunked AES-256-GCM and the access key above. New encryption requires exactly the selected access-key length; decryption is not restricted by that setting. New encrypted files use the binary HWF2 format; earlier HWF1 files up to 1 MiB remain decryptable. Original filenames and types are not stored. Large files use a Save File picker where supported; other browsers may need substantial memory to prepare the download.

File hash & integrity workbench

Calculate local digests and verify published checksums.

Drop files here or click to select calculate multiple digests locally

Choose files No file chosen

Hashing runs in a same-origin Web Worker to keep the interface responsive. Files are limited to 256 MiB per file; SHA digests require the complete file in memory, while MD5 is processed incrementally in chunks. This limit is separate from file encryption. Hashing is local; MD5 and SHA-1 are for compatibility only.

MD5 SHA1 SHA256 SHA512

Expected hash algorithm Expected digest Leave blank to calculate a digest only. To check a file you created, copy or save its digest as a baseline and compare it later. To verify a download, compare against a checksum from a source you trust. A match does not prove who created the file.