Loading page
About this tool
Encode, decode, inspect, copy, share, and export secret-message payloads with classical ciphers, Base64, URL, Morse, binary, and AES-GCM.
The Secret Message Encoder converts text between eight reversible schemes — Caesar shift (C = P + k mod 26), ROT13, Atbash, Vigenere, Base64 per RFC 4648, percent-encoding per RFC 3986, International Morse per ITU-R M.1677-1, and 8-bit binary — and adds genuine AES-256-GCM encryption with a PBKDF2-HMAC-SHA256 key at 600,000 iterations, the OWASP-recommended figure. Everything runs in the browser with nothing uploaded. It is aimed at puzzle makers, teachers demonstrating classical cryptography, and developers who need a quick encode or decode.
Open Secret Message Encoder on AltFTool — it loads instantly in your browser.
Type into the Message box, which starts on "Meet me at the old bridge at nine.", and pick an Algorithm: Caesar shift, ROT13, Atbash, Vigenere (keyword), Base64 (RFC 4648), URL percent-encoding (RFC 3986), Morse code (ITU-R M.1677-1) or Binary (8 bits per byte).
Set Direction to Encode or Decode; Caesar adds a "Shift (k)" field defaulting to 3 and Vigenere a "Keyword (letters only)" field defaulting to LEMON. For real confidentiality, type a "Passphrase (8 characters or more)" and press "Encrypt the message above".
The read-only Result box fills as you type, with Algorithm, input and output characters/bytes and FNV-1a fingerprints listed underneath; AES output appears separately as AES payload, and "Copy output" copies whichever is present.
Base64 matches the RFC 4648 test vectors and Morse follows the ITU letter set.
Classical ciphers are labelled as puzzles; only the AES panel claims confidentiality.
All encoding and the Web Crypto AES work happen locally on your device.
No — neither hides anything. ROT13 is a Caesar shift of 13 with no key at all, and Base64 is a printable representation of bytes that any tool can reverse in a keystroke. Use the AES-256-GCM option when the message genuinely needs to stay private.
Each plaintext letter is shifted by the letter of a repeating keyword: C = (P + K) mod 26, where A shifts by 0 and Z by 25. With the keyword LEMON, the classic example ATTACKATDAWN encrypts to LXFOPVEFRNHR. Punctuation and spaces pass through and do not consume key letters.
600,000 for PBKDF2-HMAC-SHA256, which is the current OWASP Password Storage Cheat Sheet recommendation and the figure this tool uses. Each message also gets a fresh 16-byte random salt and a 12-byte IV, the IV length NIST SP 800-38D specifies for GCM.
Three dots, three dashes, three dots — written ... --- ... with single spaces between letters. This tool uses the ITU-R M.1677-1 letter set, separates letters with one space and words with a forward slash, so HI THERE encodes as .... .. / - .... . .-. .