Hex Watch Cipher SECURE WORKSPACE

Protect messages with modern encryption. Encryption and decryption run locally in your browser.

Compose a secure message

Choose a cipher, set your access key, then encrypt or decrypt.

Encryption method Authenticated encryption with a random salt and IV for each message.

AES-GCM key size This selects the derived AES key size, not the number of characters in your passphrase. Keep using a long, unique passphrase; Unicode characters do not equal bytes. The encrypted token records its key size and decrypts automatically.

Access key

Required access-key length for new encryption

Access-key quality Add an access key to see an estimate.

Enter 24 characters for new password-based encryption.

Use a long, unique passphrase. You can type one or generate it securely.

Exactly 24 characters
Lowercase
Uppercase
Symbols (for example, ! @ #)
Numbers

This is a rough estimate, not a password audit. It considers length, character variety, repetition, and common sequences. Character groups are guidance, not a password requirement; the selected length is enforced for new password-based encryption.

New AES-GCM, CBC-HMAC, RSA-OAEP + AES-GCM, and file encryption require exactly the selected number of Unicode code points (characters). Decryption is not subject to this selected-length rule. Choose a long, unique passphrase; a randomly generated one is preferable to a predictable password. Maximum 4,096 UTF-8 bytes.

Digital signatures · optional sender verification

Sign an encrypted token with ECDSA P-256, or verify a signed token before decrypting. A signature proves which key signed the token, not who owns that key. Compare the public-key fingerprint through a trusted channel.

Sign encrypted output Generated signing-key handling The private key stays in page memory and is cleared when the workspace locks or the page closes. It cannot be recovered unless you import a backup. ECDSA P-256 public signing key (SPKI PEM)

SHA-256 signing-key fingerprint: Not calculated

Private signing key (PKCS#8 PEM) Private keys can sign messages as you. Keep backups secret and share only the public key.

Message or encrypted token Messages are limited to 100,000 UTF-8 bytes; encrypted tokens to 140,000 characters and signed tokens to 200,000. Keyboard shortcut: Ctrl/⌘ + Enter to encrypt; add Shift to decrypt.

Encrypt a file

Files always use AES-256-GCM, regardless of the selected text cipher.

File to encrypt or decrypt (up to 1 GiB) Maximum 1 GiB. Files use chunked AES-256-GCM with Argon2id (128 MiB, 3 passes, one lane). New encryption requires exactly the selected access-key length; decryption is not restricted by that setting. New encrypted files use the binary HWF5 format; earlier HWF4, HWF3, HWF2, and HWF1 files remain decryptable. Original filenames and types are not stored. Large files use a Save File picker where supported; other browsers may need substantial memory to prepare the download.

PRIVATE · LOCAL PROCESSING

Media & file payload workspace

Embed a payload in PNG pixels (JPEG sources become PNG), attach it inside a PDF, or append it to a video, recording, or other file for later recovery. This workspace always uses its own access key, separate from the main Access key.

01 Carrier file

Choose an image, video, audio recording, PDF, document, or other filePNG and JPEG images use pixels; PDFs keep their format with an encrypted attachment. Other files use appended data. Browse files

No carrier selected. Capacity is calculated after you choose a file.

PAYLOAD SECURITY

Encryption key

Use the same key to encrypt and recover this payload.

Required

Workspace access key

Advanced key optionsPassphrase generator and strength estimate

Passphrase length for the generator

Access-key quality Add an access key to see an estimate.

Generator target: 24 characters.

Use a long, unique passphrase. You can type one or generate it securely.

Generator target: 24 characters
Lowercase
Uppercase
Symbols (for example, ! @ #)
Numbers

This is a rough estimate, not a password audit. The selected length only controls generated passphrases; manually entered keys can use any length of at least 10 characters. Keep this workspace key to extract your payload later.

02 Payload

Text message Optional when selecting files

OR ADD A FILE COLLECTION

Files or folder

One file stays in its original format. Multiple files or a folder are bundled into a ZIP; extraction downloads the ZIP for you to open.

Or drop files here · use Choose folder for a directory

No files or folder added

Add a text message or a file collection. Maximum payload size is 4 MiB.

Encrypted before embedding

Payloads are encrypted with authenticated AES-256-GCM using the workspace access key.

Carrier capacity—

PNG capacity depends on opaque pixels. PDFs contain a native encrypted attachment; other files have encrypted data appended, which is not concealed.

Supported workflow

PNG image pixel embedding
JPEG input becomes PNG output
PDFs keep their format with a standard encrypted attachment
Video, audio, and other files use appended data
Single files stay in their original format
Folders and file collections recover as ZIP
Up to 4 MiB of payload data

Use a copy and keep the output unchanged. Editing or recompressing PNG can destroy embedded data. PDF viewers may not display attachments. For video, audio, and other files, the encrypted block is appended—not concealed—and may affect compatibility.

File hash & integrity workbench

Calculate local digests and verify published checksums.

Drop files here or click to select calculate multiple digests locally

Choose files No file chosen

Hashing runs in a same-origin Web Worker to keep the interface responsive. Files are limited to 256 MiB per file; SHA digests require the complete file in memory, while MD5 is processed incrementally in chunks. This limit is separate from file encryption. Hashing is local; MD5 and SHA-1 are for compatibility only.

MD5 SHA1 SHA256 SHA512

Expected hash algorithm Expected digest Leave blank to calculate a digest only. To check a file you created, copy or save its digest as a baseline and compare it later. To verify a download, compare against a checksum from a source you trust. A match does not prove who created the file.