Private by design

Say it in the open.
Read it in secret.

FFLK Z4 turns any message into unreadable text using real AES-256 encryption, right in your browser. Send it anywhere. Only the person with your password ever sees the words.

Try it now → See how it works
SCROLL

The tool

Encrypt. Send. Decrypt.

Pick a password only you and your friend know. Everything below runs locally — nothing you type is ever sent to a server.

Encrypt
Decrypt

How it works

Four steps, no accounts

There's no sign-up, no server, no history saved anywhere. Just a shared secret between two people.

01

Agree on a password

Pick a phrase with your friend through a separate channel — in person, a call, whatever you trust. This is the only secret that matters.

02

Encrypt your message

Type your message and the password here. Your browser scrambles it into unreadable text using AES-256 — nothing leaves your device.

03

Send the gibberish

Copy the scrambled text and send it however you like — text, email, Discord. It means nothing without the password.

04

They decrypt it

Your friend pastes it in, enters the same password, and gets your real message back — instantly, in their own browser.

Under the hood

Real encryption, not a trick

No custom cipher, no security-through-obscurity — just the same standards used by banks and secure messaging apps.

Key derivation

PBKDF2

Your password alone isn't a strong key — it's too short and guessable. PBKDF2 stretches it through 150,000 rounds of hashing combined with a random salt, turning a memorable phrase into a proper 256-bit key.

The salt

Random, every time

A fresh 16-byte value generated on every encryption. Even the same password produces a completely different key each time, so patterns never repeat.

The cipher

AES-256-GCM

The actual encryption standard, used globally. GCM mode also adds an authentication tag — if someone tampers with the message, or the password is wrong, decryption fails cleanly instead of returning garbage.

Where it runs

Only in your browser

Every operation uses the Web Crypto API, built into your browser. Your message, password, and the decrypted result never touch a server — including ours.

Questions

Before you send anything

Does the encrypted text expire?+
No. AES-256 doesn't weaken or expire over time — the same ciphertext and password will decrypt correctly whether it's opened in five minutes or five years.
What if I forget the password?+
There's no recovery option, by design. If the password is lost, the message is unreadable forever — that's what makes it secure in the first place.
Is it safe to send the password in the same message?+
No — never send the password alongside the encrypted text, or through the same channel. Share it in person, on a call, or somewhere separate from where the ciphertext travels.
Can anyone else read my message?+
Only someone with both the exact encrypted text and the correct password. Without the password, brute-forcing AES-256 is not practically possible with any existing technology.