Hesapica • In-Browser Encryption

Text Encryption & Decryption

Encrypt text with a password or decrypt an HC1 or HC2 message you received using the correct password. Processing happens in your browser; plaintext and passwords are not sent to Hesapica servers. Multiple languages, writing systems, special characters and emojis are supported.

AES-256 + HMACPassword-basedRuns in your browser100,000 characters🌍 Multilingual & Unicode

Send a password-protected secret message in 3 steps

No technical setup needed: encrypt a short note, share the encrypted output, and let a friend decrypt it with the same password on another device. Example: “Meet me tomorrow at 7 PM! 🔐”

1. Write your messageChoose “Encrypt”, enter your text, and create a hard-to-guess password of at least 8 characters. Confirm the password.
2. Encrypt and copySelect “Encrypt Text”. Copy the resulting encrypted text starting with HC2: and send it to your friend.
3. Decrypt with the same passwordYour friend opens “Decrypt” on Hesapica, pastes the encrypted text, and enters the exact same password to read it.

Security tip: Send the password separately via a trusted channel when possible. Forgotten passwords cannot be recovered. Encryption runs in your browser.

Encrypt or Decrypt Text

Choose a mode, enter the text and password. For better security, avoid sharing the password through the same channel as the encrypted text.

Text to encrypt

Text is processed on your device.

Password

Confirm password

Password rule: Use at least 8 characters. Letters, numbers, spaces, and symbols are allowed; no specific symbol type is required. For stronger protection, choose a long, unique password. Hesapica cannot recover a forgotten password.

Show password

How does text encryption work?

New encryptions are produced in HC2 format. PBKDF2-SHA-256 derives separate encryption and authentication keys from the password; the text is encrypted with AES-256-CBC and authenticated with HMAC-SHA-256. This is designed for broader interoperability across browsers including iPhone/Safari. Older AES-256-GCM based HC1 messages remain decryptable.

Why does the password matter?

The security of encrypted text depends not only on the algorithm but also on how difficult your password is to guess. Use a long, unique password. Hesapica does not store your password and cannot recover a forgotten one.

How should I share an HC1 / HC2 message?

You can send the encrypted output beginning with HC1 or HC2 through a messaging app, email, or another channel. When possible, share the password through a separate trusted channel. Altering or truncating the encrypted text will cause decryption to fail.

🌍 Multilingual and Unicode text support

Unicode support lets you encrypt text in Turkish, English, German, French, Spanish, Arabic, Russian, Greek, Chinese, Japanese, Korean and other languages represented in Unicode. Non-Latin scripts, accented characters, special characters and emojis are preserved during encryption and decryption.

Merhaba 🌍 · Hello · مرحبا · Привет · 你好 · こんにちは · 안녕하세요

You can also mix multiple languages in the same message. The tool processes the characters as UTF-8 without translating or rewriting your text.

Before sharing an encrypted message

Copy the complete output

Send the entire long string beginning with HC2:. A missing or changed character may prevent the recipient from decrypting it.

Share the password separately

The recipient needs the correct password to unlock the message. When possible, use a separate trusted channel to share that password.

Test before sending

For an important message, switch to Decrypt and test the output using the same password. Forgotten passwords cannot be recovered by Hesapica.

Why can't I decrypt a message?

Check that the text begins with HC1: or HC2: and that you copied the full output. Confirm you are entering the same password. Edited or incomplete ciphertext and incorrect passwords cause verification to fail. If your password contains special characters, enter it consistently on both devices.

What is this tool suitable for?

It can help people exchange password-protected notes and short messages. It is not a substitute for an end-to-end secure messaging service: it does not verify the recipient's identity, safely distribute passwords, or protect a compromised device. Use established, independently assessed security solutions for highly sensitive information.

Privacy and security note

Encryption and decryption use the Web Crypto API in your browser. This page is not designed to send plaintext or passwords to a server. Device security, malicious browser extensions, screenshots, and weak password choices are outside the tool’s control.

Frequently Asked Questions

Does the same password work on another device?

Yes. If the recipient has the complete HC1/HC2 output and the correct password, they can decrypt it in a compatible modern browser.

Can I use a different password for every message?

Yes. Each encryption operation is independent, so you can choose a different password for every message.

Will I get the same output if I encrypt the same text with the same password?

No. A new random salt and IV are generated for each operation, so the encrypted HC1/HC2 output will normally be different.

Can I recover the text if I forget the password?

No. Hesapica does not store your password and there is no password-recovery mechanism. The encrypted text is designed not to decrypt without the correct password.

Which languages can I encrypt?

Unicode support allows text in different languages and writing systems, including special characters and emojis. Multiple languages can also be used in the same message.

What is the text length limit?

This tool accepts up to 100,000 characters per operation. The limit keeps browser performance and shareable output size practical.