ChaCha20-Poly1305 Encrypt & Decrypt Online
Modern authenticated stream cipher, password-based.
About this tool
ChaCha20-Poly1305 is the authenticated stream cipher that TLS 1.3, WireGuard, and SSH reach for when AES hardware acceleration isn't available — it's fast in pure software and immune to the timing attacks that plague table-based AES. This tool derives a 256-bit key from your password with PBKDF2-SHA-256, generates a random nonce, and appends a Poly1305 authentication tag so any tampering is detected on decryption.
The output is a single Base64 string containing salt, nonce, ciphertext, and tag. Everything runs through the audited @noble/ciphers library in your browser — your message and password never leave the page.
Like everything on encrypt.tools, this runs entirely in your browser — nothing you enter is transmitted or stored.
Frequently asked questions about ChaCha20-Poly1305
Is ChaCha20 more secure than AES?+
Neither is stronger in raw security — both are considered unbroken at 256-bit keys. ChaCha20 is preferred on devices without AES hardware acceleration because it is fast and constant-time in pure software, which resists timing side-channel attacks. TLS 1.3 offers both and picks per-connection.
What does the Poly1305 part do?+
Poly1305 is a message authentication code appended to the ciphertext. On decryption it is checked first; if even one bit of the ciphertext was altered, decryption fails rather than returning garbage. This is what makes ChaCha20-Poly1305 an AEAD (authenticated encryption with associated data) cipher.
Can I decrypt this with OpenSSL or another tool?+
Not directly — this tool uses its own compact container format (salt, nonce, ciphertext, tag packed into Base64) with PBKDF2 key derivation. It is designed for encrypting and decrypting within encrypt.tools, not as an interoperable file format.
Does my password or message get uploaded?+
No. Key derivation and encryption run entirely in your browser via the Web Crypto API and @noble/ciphers. Nothing you type is sent to any server.
Related tools
AES Encryption
Encrypt text with AES-256 in GCM, CBC, or CTR mode
XOR · BRUTEFORCEXOR Cipher
Bitwise XOR with a repeating key, plus single-byte bruteforce
SALSA20 · STREAMSalsa20
The stream cipher that ChaCha20 was built from
RC4 · STREAMRC4 Stream Cipher
The classic (broken) stream cipher, for education and interop