"Encrypted" gets used loosely online, sometimes describing things that offer no real security at all. Knowing the actual difference matters if you're deciding whether something is safe to send or store.
Encoding Is Not Encryption
Base64 and ROT13 are encodings — fixed, publicly known transformations with no secret involved anywhere in the process. Anyone who recognizes Base64 text can decode it instantly with a single line of code or an online tool; there's no password to guess or key to find, because none exists. Real encryption, like AES-256, is fundamentally different: it transforms data using a secret key or password, and without that exact secret, reversing the transformation is computationally infeasible — not just inconvenient, but practically impossible with any amount of realistic computing power.
What the Web Crypto API Actually Does
Modern browsers include a built-in Web Crypto API — a set of cryptographic functions implemented natively, audited, and optimized by the browser vendors themselves rather than written from scratch in JavaScript. Using it means real encryption operations (like AES-256-GCM) run through a trusted, standard implementation instead of custom code, which matters because cryptography is notoriously easy to get subtly wrong when implemented by hand, even by experienced developers.
Why There's No "Forgot Password" Option
Strong encryption has no back door, master key, or recovery mechanism by design — that's precisely what makes it trustworthy. The password is used to mathematically derive the exact key needed for decryption, and without it, there is no shortcut to recovering the original text, regardless of computing power applied. This is a feature, not an oversight: any built-in way to bypass a forgotten password would also be a way for an attacker to bypass it, undermining the entire point of encrypting the data in the first place.
Encrypt Some Text
Encrypt or decrypt any text with a password using real AES-256 encryption in the free Text Encryption tool — nothing is ever sent to a server.
FAQ
Why isn't Base64 or ROT13 real encryption? Base64 and ROT13 are encodings, not encryption — reversible transformations that require no secret key or password at all. Anyone who recognizes the format can decode them instantly using any standard tool. Real encryption like AES-256 requires a specific password or key to reverse; without it, the encrypted data is computationally infeasible to recover.
What is the Web Crypto API? It's a set of cryptographic functions built directly into every modern browser, allowing a webpage to perform real, industry-standard encryption and decryption using the browser's own optimized, audited implementation rather than relying on custom JavaScript encryption code, which is far more prone to subtle security flaws.
What happens if I forget the password I encrypted something with? The data is unrecoverable. Strong encryption like AES-256 has no back door or master key — the password is mathematically required to derive the decryption key, and without it, recovering the original text is not practically possible even with significant computing power. There's no "forgot password" option for real encryption, which is the entire point of it being secure.