Encrypt it here.
Nobody, including us,
ever sees it.
QuantumKey turns a passphrase into a real AES-256 key, right in your browser tab. No account, no server, no upload. Close the tab and it's like it never happened.
Three steps, none of them touch a server.
The math happens locally using the Web Crypto API already built into your browser.
Set a passphrase
PBKDF2-SHA256 at 200,000 or 600,000 rounds with a fresh random salt derives a unique AES-256 key — never sent anywhere.
Encrypt text, files or many files
Get an encrypted blob, a downloaded .enc file, or a shareable link whose key material lives only in the URL fragment — the part browsers never transmit.
Decrypt with the same phrase
Anyone with the ciphertext and the passphrase can reverse it. Nobody else can — not even us.
Try it right now.
Type something, set a passphrase, and watch it come back out the other side. Press ⌘K to jump anywhere.
Convert files — without uploading them.
Every conversion runs inside your browser. The file you pick never leaves your device. Formats marked soon need server-side processing, which this tool deliberately does not do.
Everything else you reach for during the day.
Passwords, hashes, PDFs, images, JWT, diff, regex, QR — all computed locally. Nothing is sent, logged or stored.
Diff checker.
Paste two versions of a text and see exactly what changed — line by line, with additions and deletions marked.
The wire format, in plain text.
Everything QuantumKey writes uses the same container. If you want to decrypt outside this page, this is the spec — copy it into your own project.
QuantumKey container v2 (all integers little-endian)
Offset Size Field
0 1 magic0 = 0x51 ("Q")
1 1 magic1 = 0x4B ("K")
2 1 version = 0x02
3 1 flags bit 0 = payload is gzip-compressed
4 4 iterations PBKDF2 round count (uint32)
8 16 salt random, per message
24 12 iv random, per message (AES-GCM nonce)
36 N ciphertext AES-256-GCM( plaintext, key, iv )
Key derivation:
key = PBKDF2( passphrase, salt, iterations, SHA-256 ) → 256-bit
File container (encrypted as a whole):
"F" "K" (2 bytes) · nameLen (2 bytes LE) · name (UTF-8) · content bytes
Everything after byte 35 is authenticated by AES-GCM, so tampering is detected.
// Minimal decrypt, using the same Web Crypto API this tool uses.
async function decrypt(containerBuffer, passphrase) {
const b = new Uint8Array(containerBuffer);
if (b[0] !== 0x51 || b[1] !== 0x4B) throw new Error("Not a QuantumKey blob");
const flags = b[3];
const iterations = new DataView(b.buffer).getUint32(4, true);
const salt = b.slice(8, 24);
const iv = b.slice(24, 36);
const ct = b.slice(36);
const base = await crypto.subtle.importKey(
"raw", new TextEncoder().encode(passphrase), "PBKDF2", false, ["deriveKey"]);
const key = await crypto.subtle.deriveKey(
{ name: "PBKDF2", salt, iterations, hash: "SHA-256" },
base, { name: "AES-GCM", length: 256 }, false, ["decrypt"]);
let plain = new Uint8Array(
await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ct));
if (flags & 1) {
plain = new Uint8Array(await new Response(
new Blob([plain]).stream().pipeThrough(new DecompressionStream("gzip"))
).arrayBuffer());
}
return new TextDecoder().decode(plain);
}
Questions people actually ask.
Is anything I type sent to a server?
No. Encryption, decryption, hashing, PDF manipulation, background removal, JWT decoding, diff, regex, QR and password generation all run inside this tab.
The only outbound calls are: (a) Google Fonts for the typeface, (b) the PDF/QR libraries from a public CDN the first time you use them. Your files and text never leave the tab.
What happens if I forget the passphrase?
The data is gone. There is no recovery flow, no backdoor, no "reset" email. That's the whole point.
How strong should my passphrase be?
Long beats clever. A four- to six-word passphrase like harbor-velvet-canyon-ember-42 is easier to remember and harder to crack than a short mixed-case jumble.
What's the difference between Standard and Paranoid?
Both derive a 256-bit AES key from your passphrase using PBKDF2-SHA256. Standard uses 200,000 rounds; Paranoid uses 600,000. The round count is stored in the ciphertext header, so decryption auto-detects.
Does the background remover use AI?
No — it's a colour-key remover, not an AI matting model. Works brilliantly on solid-background images. For hair and foliage, use a real AI matting tool.
Is the JWT decoder safe?
Yes, because it only decodes the Base64 segments. It does not verify the signature, and it never asks you for the secret or private key — a signed token's secret should never be pasted into a web page you don't control, including this one.
Can I use QuantumKey offline?
Yes — once the page has loaded, everything except the PDF and QR libraries works offline. Those libraries cache after their first successful load.
Zero-knowledge isn't a slogan here.
No account, no upload
There's nothing to sign up for and nothing leaves your device.
Fresh salt, every time
Encrypting the same text twice gives different output — that's the encryption working correctly.
No recovery, by design
Forgetting the passphrase means the data is gone. There's no backdoor to build in the first place.
Built on Web Crypto
AES-256-GCM, PBKDF2-SHA256, SHA-1/256/384/512 and HMAC via the browser's native crypto engine.
Share links stay local
The ciphertext rides in the URL fragment after the #. Browsers never transmit that part of a URL.
It tidies up after itself
Passphrases, outputs and generated secrets wipe after a few idle minutes, and the clipboard clears about 45 seconds after a copy.
Only safe things persist
Your theme choice, iteration count, compression preference and last active tab are saved to localStorage. Passphrases, outputs and secrets are never written to disk.
Honest about the limits
AES-256 is not the weak point — your passphrase is. And background removal is colour-key, not AI matting. Both tools say so.