ChaCha20 Encryption: Encrypt Text With a Passphrase

To encrypt text with ChaCha20, paste the message, enter a passphrase of at least eight characters, and run it. The tool returns a single text envelope beginning with CTC1 that you can paste into an email, a note or a chat. To decrypt, paste the envelope and the same passphrase. The work happens in your browser, so the passphrase is never sent to the server.

This is real authenticated encryption, not a toy cipher. The tool uses ChaCha20-Poly1305 with a 256-bit key derived from your passphrase using PBKDF2-HMAC-SHA256 at 600,000 iterations. A fresh random salt and nonce are generated for every message, and the authentication tag is checked before any plaintext is shown.

#What the envelope contains

The output is one line with six dot-separated fields:

CTC1.<iterations>.<salt>.<nonce>.<tag>.<ciphertext>

• CTC1 identifies the format and version.
• Iterations records the key-derivation cost, so a future tool can read old envelopes.
• Salt is 16 random bytes, unique per message.
• Nonce is 12 random bytes, also unique per message.
• Tag is the 16-byte Poly1305 authentication tag.
• Ciphertext is the encrypted message.

The variable fields are Base64. Because the salt and nonce are random, encrypting the same text twice produces two different envelopes. That is what stops an observer from seeing that two messages are identical.

#How to encrypt or decrypt text

1. Open the ChaCha20 encryption tool.
2. Choose Text to encrypted envelope or Envelope to text.
3. Paste the text or the complete CTC1... envelope.
4. Enter the passphrase. It must be at least eight characters.
5. Press Run.
6. Copy the output. For decryption, the plaintext appears only if the envelope authenticates.

There is no key file and no account. The passphrase is the key material, derived into an encryption key each time.

#Why the passphrase length matters

Eight characters is the minimum, not a recommendation. PBKDF2 with 600,000 iterations makes guessing slower, but it cannot rescue a weak passphrase. A short dictionary word is still a short dictionary word.

A better approach is a passphrase of several unrelated words, or a generated password stored in a password manager. Length is the dominant factor. Punctuation helps, but "correct horse battery staple" is stronger than "P@ssw0rd!".

The tool does not enforce complexity rules beyond the minimum because complexity rules tend to produce predictable substitutions. It does report the work factor, so you can see what the envelope expects.

#What authentication means here

ChaCha20-Poly1305 is an AEAD construction: it encrypts and authenticates in one step. If the passphrase is wrong, or the envelope was altered, the tag check fails and the tool says so. It does not return garbage plaintext.

That is a meaningful difference from older modes where a wrong key produces random-looking output and no error. Here, a failed decryption is unambiguous: the passphrase is wrong or the ciphertext changed.

The tag covers the ciphertext, but not the human-readable fields in the envelope. The parser also checks the salt, nonce and tag lengths and the recorded iteration count, so a malformed envelope is rejected before decryption.

#Common problems and fixes

"That does not look like an envelope." The input does not start with CTC1. Paste the whole line, including the prefix.

"It should be six dot-separated fields." Part of the envelope was cut off, or a line break was inserted in the middle. Copy the complete value.

"The passphrase is wrong, or the envelope was changed." The tag did not authenticate. Check the passphrase first; if it is definitely correct, the envelope was altered or truncated.

"The contents are not valid UTF-8 text." The envelope authenticated, so the passphrase is right, but the decrypted bytes are not text. This tool encrypts and decrypts text, not arbitrary files.

The input is rejected as too long. The limit is 500,000 characters. Split the message or encrypt a file with a dedicated tool.

A copied envelope has spaces or newlines. Some chat apps wrap long lines. Remove the whitespace before pasting; the parser expects one continuous value.

I lost the passphrase. There is no recovery. The tool stores nothing, and the ciphertext is designed to be unreadable without the key. That is the point, and it is also the risk.

#Security properties and limits

What this tool does well:

• Confidentiality: the ciphertext reveals nothing about the plaintext without the passphrase.
• Integrity: tampering is detected by the authentication tag.
• Fresh randomness: a new salt and nonce per message prevent identical ciphertexts.
• Slow key derivation: PBKDF2 raises the cost of guessing a passphrase.
• Local processing: the passphrase is not transmitted to the server.

What it does not do:

• Key management. You still have to choose, share and store the passphrase safely. Share it through a different channel from the ciphertext.
• Sender authentication. A shared passphrase proves knowledge of the secret, not who sent the message. Anyone with the passphrase can create a valid envelope.
• Metadata protection. The envelope hides the message, not the fact that you sent one, when you sent it, or to whom.
• File encryption. The tool is built for text and rejects non-UTF-8 output. Use a dedicated file encryption tool for documents and archives.
• Forward secrecy. A single long-lived passphrase means one compromise exposes every message encrypted with it.

#Tips for using it safely

• Use a long passphrase. Four or more random words beats a short complex password.
• Share the passphrase out of band. Send the envelope by email and the passphrase by Signal, or vice versa. Never put both in the same message.
• Do not reuse one passphrase for everything. A leak in one context should not open every other message.
• Keep the whole envelope. A missing character breaks the tag check.
• Treat the ciphertext as public. It is safe to paste into a chat, but it is not anonymous.
• Do not paste secrets into a page you do not trust. This tool runs locally, but the habit protects you everywhere.
• Record nothing you cannot afford to lose. There is no password reset and no recovery key.

#ChaCha20 vs AES

Both are strong modern ciphers. AES is hardware-accelerated on most processors and is the default in many systems. ChaCha20 is fast in software and avoids timing pitfalls on platforms without AES hardware support. For a text tool in a browser, either would be secure; the important part is the authenticated mode and the key derivation, not the brand name.

What you should avoid is unauthenticated encryption, a homemade scheme, or a passphrase stretched with a single hash. The envelope here records its KDF cost so the format can evolve without silently weakening old messages.

#Frequently asked questions

#Bottom line

ChaCha20-Poly1305 with a slow KDF and fresh randomness is a sound way to protect a text message with a shared passphrase. It is not a replacement for a password manager or a full key-management system, but it is honest about its limits. Open the ChaCha20 encryption tool, use a long passphrase, and share it through a different channel from the envelope.