Is encryptalotta really free?

Yes. encryptalotta is free, open source, and ad-free. There are no premium tiers, accounts, or upsells. The site is hosted on Cloudflare Pages and the entire codebase is on GitHub.

Are my keys or files uploaded to any server?

No. Every operation runs locally in your browser. The site enforces a strict Content Security Policy with connect-src 'none', which means the page is structurally unable to make outbound network requests. No analytics, no telemetry, no CDN.

How do I verify the code is what I think it is?

All third-party JavaScript (OpenPGP.js, qrcode-generator, secrets.js-grempe) is vendored locally with SHA-384 hashes recorded in two places: an HTML comment beside each tag and the manifest section in README.md, and re-verified at audit time. Run scripts/audit-release.js to re-hash on disk.

Does encryptalotta work offline?

Yes. Once the page has loaded, every tool works without an internet connection. You can also clone the repository and run encryptalotta.com locally — open index.html in any modern browser.

What languages are supported?

English, French, Simplified Chinese, German, and Hindi. Pre-rendered locale variants live at /fr/, /zh/, /de/, and /hi/. The browser auto-selects based on navigator.language, with a manual switcher in the top bar.

Encrypt A Lotta

Generate PGP Key Pair

100% Client-Side: Your keys are generated locally in your browser. Nothing is sent to any server.

Your Name *

Your Email *

Comment (Optional)

Regulator Preset

Algorithm *

Key Size *

Key Expiration *

Passphrase *

Use a strong passphrase - you cannot recover your key without it!

Confirm Passphrase *

Encrypt Files

100% Client-Side: Your files are encrypted locally in your browser. Nothing is uploaded to any server.

File Size Limit: For best performance, keep files under 100MB. Files over 500MB may cause browser slowdown or crashes. Very large files (1GB+) are not recommended.

Recipient's Public Key *

Or upload a .asc file:

Files to Encrypt *

Drag & drop files here

or click to select files

Decrypt Files

100% Client-Side: Your files are decrypted locally in your browser. Nothing is uploaded to any server.

File Size Limit: For best performance, keep files under 100MB. Files over 500MB may cause browser slowdown or crashes. Very large files (1GB+) are not recommended.

Your Private Key *

Or upload a .asc file:

Passphrase *

Files to Decrypt *

Drag & drop encrypted files here

or click to select files

Sign Files or Messages

100% Client-Side: All signing operations happen locally in your browser. Nothing is uploaded to any server.

Your Private Key *

Or upload a .asc file:

Passphrase *

What do you want to sign?

Text Message Cleartext Signature File

Message to Sign *

Verify Signatures

100% Client-Side: All verification operations happen locally in your browser. Nothing is uploaded to any server.

Signer's Public Key *

Or upload a .asc file:

What do you want to verify?

Signed Message Cleartext Signature Detached Signature

Signed Message or Cleartext Signature *

Text Message Encryption

Encrypt and decrypt text messages using PGP. Perfect for secure emails, chat messages, and notes.

100% Client-Side: Your messages are encrypted locally in your browser. Nothing is sent to any server.

What do you want to do?

Encrypt a message Decrypt a message

Recipient's Public Key *

Message to Encrypt *

Password-Only Encryption

Encrypt files using just a password - no PGP keys required. Perfect for personal file encryption or sharing files with anyone.

100% Client-Side: Your files are encrypted locally in your browser. Nothing is uploaded to any server.

What do you want to do?

Encrypt files Decrypt files

Password *

Use a strong password - you cannot recover your files without it!

Files *

Drag & drop files here

or click to select files

Key Information

Inspect any PGP key to see its fingerprint, algorithm, creation date, expiration, and user IDs. Works with both public and private keys.

100% Client-Side: Keys are analyzed locally in your browser. Nothing is sent to any server.

PGP Key (Public or Private) *

Or upload a .asc file:

Password Generator

Generate cryptographically secure passwords using your browser's built-in random number generator. Perfect for creating strong passphrases for your PGP keys.

100% Client-Side: Passwords are generated locally using crypto.getRandomValues(). Nothing is sent to any server.

Password Length

Number of Passwords

Character Sets

Uppercase (A-Z) Lowercase (a-z) Numbers (0-9) Symbols (!@#$%...)

Revocation Certificate

Generate a revocation certificate for your key. If your key is ever compromised, you can publish this certificate to invalidate it.

100% Client-Side: Certificates are generated locally in your browser. Nothing is sent to any server.

Important: Store your revocation certificate in a safe place, separate from your private key. Generate this immediately after creating a new key pair.

Your Private Key *

Passphrase *

Revocation Reason

Armor Converter

Convert PGP data between ASCII-armored text format and raw binary format. ASCII armor makes binary data safe for copying, pasting, and email.

100% Client-Side: All conversions happen locally in your browser. Nothing is sent to any server.

What do you want to do?

Dearmor (ASCII to Binary) Armor (Binary to ASCII)

Armored PGP Data *

Encrypted QR Code Generator

Hand-to-hand sharing. Encode a public key or an encrypted message into a QR code. 100% client-side — nothing is uploaded.

Text to encode (public key or encrypted message) *

Error correction level

Cell size (px)

Steganography (Image Hiding)

Steganography hides existence, not content. Always encrypt your message first (Text Messages tab), then hide the encrypted block here. PNG output only — JPEG would destroy the hidden bits. Sophisticated steganalysis can detect LSB modification; this is for casual concealment, not nation-state adversaries.

Cover image (PNG only) *

Payload to hide (encrypted message recommended) *

Password (optional, scrambles payload bytes)

Shamir's Secret Sharing

Split a secret into N shares; need K to reconstruct. Use this for passphrases, private keys, or seed phrases. Each share leaks the length of the secret — pad to a fixed size if length is sensitive. 100% client-side.

Secret to split *

Total shares (N)

Threshold (K)

EXIF Eraser

Strip GPS, camera serial, timestamps and more. Drop or select images. Each is re-encoded via canvas, which produces a metadata-free copy. 100% local — nothing is uploaded. Note: re-encoding recompresses the image; for lossless metadata-only removal of a JPEG, use a desktop tool.

Images (JPEG, PNG, WebP)

Output format

Quality (JPEG/WebP) 92

Hash & Checksum

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Text input:

Or pick a file:

Compare two hashes

Hash A:

Hash B:

HMAC

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Algorithm:

Key: Key is hex-encoded

Message:

HMAC (hex):

Verify a known HMAC

Expected HMAC (hex):

Encode / Decode

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

From:

Input:

To:

Output:

UUID / ULID Generator

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Format:

How many:

Output:

Unix Timestamp Converter

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Input (Unix seconds, milliseconds, or ISO 8601):

URL Parser

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

URL:

Encode/decode result:

JWT Inspector

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Reminder: JWT payloads are Base64-encoded, not encrypted. Treat any production token like a credential — verify locally, never paste it into untrusted online inspectors.

JWT (paste the full token):

Verifier checks (optional)

JWT (RFC 7519)

Expected issuer (iss claim):

Expected audience (aud claim):

SD-JWT KB-JWT

Expected audience (KB-JWT aud claim):

Expected nonce (KB-JWT nonce claim):

Verify the signature

Pick the algorithm matching the JWT header, then provide the matching key. RS256/ES256 use a PEM-formatted public key; HS256/384/512 use a shared secret.

Public key (PEM) or shared secret:

TOTP / 2FA Code Generator

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Treat the secret like a password: Whoever has the TOTP secret can generate the same codes you do. Don't paste it into untrusted tools, screenshot it, or send it through unencrypted channels.

Secret or otpauth:// URI:

Algorithm:

Digits:

Period (sec):

Diff Tool

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Original (A):

Modified (B):

Ignore whitespace Ignore case

CSV ↔ JSON ↔ TSV Converter

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Input:

Input format:

Output format:

First row is header

Output:

Regex Tester

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Pattern:

Flags:

Test string:

Replacement (optional):

Replaced output:

TLS Certificate Parser

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

PEM-encoded X.509 certificate:

SSH Key Parser

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

OpenSSH public key (one line):

PEM ↔ DER Converter

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Input (PEM text or DER as hex / Base64):

PEM block label (when encoding to PEM):

Output:

Cron Decoder

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Cron expression (5 fields: min hour dom month dow):

Color Converter

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Color (any format):

Pick:

WCAG contrast checker

Compare foreground and background; AA needs ≥ 4.5:1 for normal text, AAA needs ≥ 7:1.

Foreground:

Background:

Format & Convert

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

TOML note: TOML support is intentionally omitted: no small browser-ready TOML parser exists without a build step (smol-toml is ESM-only; @ltd/j-toml is 100 KB+). Use JSON or YAML for now.

Input:

Input format:

Output format:

Mode:

Output:

CIDR / Subnet Calculator

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

CIDR (IPv4):

PBKDF2 Key Derivation

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Password

Salt (text or hex)

Salt format

Regulator Preset

Iterations

Key length (bytes)

PRF (hash)

BIP39 Mnemonic

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Word count

Passphrase (optional)

Mnemonic

Number Base Converter

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Number

Input base (auto-detects 0x / 0b / 0o)

Custom base (2–36)

IBAN Validator / Generator

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

IBAN

Generate a test IBAN

For test data only. Do not use generated IBANs for real transactions.

Country

BBAN (optional — random if empty)

BIC / SWIFT Code Checker

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

BIC / SWIFT

GS1 Barcode Checksum

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Barcode digits (EAN-8 / EAN-13 / UPC-A / UPC-E / ITF-14 / GTIN-14 / SSCC)

EU VAT Number Validator

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Syntactic check only. To confirm the VAT number is actively registered, use the EU Commission’s VIES service (link in “About this tool” below). Personal-identity numbers (ES NIF/NIE, IT Codice Fiscale, PL PESEL, etc.) are deliberately not supported.

VAT number (with or without country prefix)

SEPA ISO 20022 XML Inspector

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Paste SEPA XML (pain.001 credit-transfer initiation or camt.053 bank-to-customer statement)

eIDAS Trust List (LOTL / TSL) Viewer

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Paste the LOTL (List of Lists) or a member-state TSL (Trust Service Status List) XML

PEPPOL / UBL Invoice Inspector

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

Paste an OASIS UBL 2.1 Invoice or CreditNote XML (PEPPOL BIS Billing 3.0, EN 16931 / Factur-X CII not yet)

Ed25519 — Sign / Verify

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

1. Generate keypair

Public key (32 bytes, hex)

Private key (32-byte seed, hex)

2. Sign a message

Message (UTF-8 text or hex with 0x prefix)

Signature (64 bytes, hex)

3. Verify a signature

X25519 — Key Agreement (ECDH)

100% Client-Side: All operations happen locally in your browser. Nothing is uploaded to any server.

1. Generate local keypair

Local public key (32 bytes, hex)

Local private key (32 bytes, hex)

2. Peer public key

Peer public key (32 bytes, hex)

3. Derive shared secret

HKDF post-processing

HKDF "info" context (optional, UTF-8)

Shared secret (hex)

All tools

Keys

Encrypt / Decrypt

Sign / Verify

Utilities

Generate PGP Key Pair

CRITICAL: SAVE YOUR KEYS NOW!

Keys Generated Successfully

Public Key (Share this):

Private Key (KEEP SECRET!):

Encrypt Files

Decrypt Files

Sign Files or Messages

Verify Signatures

Text Message Encryption

Password-Only Encryption

Key Information

Password Generator

Revocation Certificate

Armor Converter

Encrypted QR Code Generator

Steganography (Image Hiding)

Shamir's Secret Sharing

EXIF Eraser

Hash & Checksum

Compare two hashes

HMAC

Verify a known HMAC

Encode / Decode

UUID / ULID Generator

Unix Timestamp Converter

URL Parser

JWT Inspector

Verify the signature

TOTP / 2FA Code Generator

Diff Tool

CSV ↔ JSON ↔ TSV Converter

Regex Tester

TLS Certificate Parser

SSH Key Parser

PEM ↔ DER Converter

Cron Decoder

Color Converter

WCAG contrast checker

Format & Convert

CIDR / Subnet Calculator

PBKDF2 Key Derivation

BIP39 Mnemonic

Number Base Converter

IBAN Validator / Generator

Generate a test IBAN

BIC / SWIFT Code Checker

GS1 Barcode Checksum

EU VAT Number Validator

SEPA ISO 20022 XML Inspector

eIDAS Trust List (LOTL / TSL) Viewer

PEPPOL / UBL Invoice Inspector

Ed25519 — Sign / Verify

1. Generate keypair

2. Sign a message

3. Verify a signature

X25519 — Key Agreement (ECDH)

1. Generate local keypair

2. Peer public key

3. Derive shared secret