- Home
- Encrypt
- Encrypt / Decrypt
- ChaCha20
ChaCha20 Encryption & Decryption
Encrypt and decrypt text with ChaCha20-Poly1305 or plain ChaCha20.
You'll need it again to decrypt. Nothing you type leaves this page.
OpenSSL's default is 10,000. Any number works: more makes the password slower to guess; decrypting needs the same number.
Authenticated: a wrong password or key, or any change to the text, is detected.
OpenSSL's enc command can't read ChaCha20-Poly1305. Decrypt it here, or in code with a crypto library: the 16-byte tag follows the ciphertext.
ChaCha20-Poly1305 (RFC 8439) is the authenticated cipher used in TLS 1.3 and WireGuard: it encrypts text and also detects any change to it, or a wrong password. Encrypt text here with a password or your own 256-bit key and 12-byte nonce, or paste Base64 or hex ciphertext to decrypt it. With a password, the key and nonce come from PBKDF2-HMAC-SHA256 with a random salt, as in openssl enc -pbkdf2, and the output is Salted__, the salt, the ciphertext and the 16-byte Poly1305 tag. Plain ChaCha20, without the tag, is here too, in the layout of OpenSSL's chacha20. Your text, passwords and keys never leave your device: it runs in your browser, free, with no sign-up.
How to encrypt text with ChaCha20-Poly1305
- Choose Encrypt or Decrypt. Type the text to encrypt, or paste the Base64 or hex text to decrypt — the format is detected automatically.
- Enter a password (Generate makes a strong one), or switch to Key & IV (hex) and enter or generate a 64-digit key and a 24-digit nonce (a 32-digit IV for plain ChaCha20).
- Keep ChaCha20-Poly1305, or choose ChaCha20 to match openssl enc -chacha20. To decrypt, use the same mode, password and iteration count that encrypted the text.
- Copy or download the result, or press Swap to move it into the input and decrypt it again as a check.
Features
- ChaCha20-Poly1305 as in RFC 8439: 256-bit key, 12-byte nonce, 16-byte tag
- Plain ChaCha20 in OpenSSL's layout: a 16-byte IV made of a 4-byte little-endian counter and the 12-byte nonce
- Password mode: key and nonce from PBKDF2-HMAC-SHA256 with a random salt, behind the Salted__ header of openssl enc -pbkdf2
- Key & IV mode: your own hex key and nonce, or random ones from Generate
- With Poly1305, a wrong password or key, or one changed character, makes decryption fail instead of returning garbage
- No padding: the ciphertext is as long as the text, plus the 16-byte tag with Poly1305
- The openssl enc -chacha20 command for plain ChaCha20
Is it private?
Yes. ChaCha20 runs in WebAssembly inside your browser, and the password is stretched by the browser's Web Crypto. Nothing you type — text, password, key or nonce — is uploaded or saved.
Frequently asked questions
ChaCha20-Poly1305 or plain ChaCha20?
ChaCha20-Poly1305, the default, for anything new: its Poly1305 tag makes decryption fail if one character was changed or the password is wrong. Plain ChaCha20 only encrypts — a wrong key gives unreadable bytes instead of an error — so use it only to match a system that uses it, such as openssl enc -chacha20.
Can OpenSSL decrypt it?
Plain ChaCha20, yes: echo 'U2FsdGVkX1…' | openssl enc -d -chacha20 -pbkdf2 -iter 10000 -a -A for password mode, or -K <key hex> -iv <IV hex> instead of -pbkdf2 -iter in Key & IV mode. ChaCha20-Poly1305, no: openssl enc refuses AEAD ciphers. Read it here, or in code: in Key & IV mode the output is the ciphertext followed by the 16-byte tag, with no header.
What happens if a nonce is reused?
Two messages under the same key and nonce reveal the XOR of their texts, and let an attacker forge Poly1305 tags. In password mode you can't make that mistake: every encryption picks a new random salt, so the key, the nonce and the output are new each time. In Key & IV mode, press Generate for a new nonce before every message.
Is ChaCha20 as secure as AES?
Yes. ChaCha20-Poly1305 and AES-GCM are both standard TLS 1.3 ciphers with no practical attack, and ChaCha20 is often faster on phones without AES hardware. The weak point is the password: use a long random one, and the 600,000-iteration setting when you control both sides.
Does it support XChaCha20-Poly1305?
No. XChaCha20, the 24-byte-nonce variant found in libsodium, is a different construction, so its ciphertext can't be decrypted here. This page takes RFC 8439's 12-byte nonce and OpenSSL's 16-byte chacha20 IV. To encrypt a file rather than text, File Encryption uses ChaCha20-Poly1305 in the age format.