Private by design

Protect files without uploading them.

Encrypt a file with authenticated browser-native cryptography, or create a standard encrypted 7z archive that recipients can open with normal 7z-compatible software.

Encrypt a file

Create an authenticated .enc file using the SecurBrowser v2 format.

AES-256-GCM

Drop a file here or choose a file from this device

Passphrase

Confirm passphrase

Use at least 8 characters; a longer passphrase is recommended.

Decrypt a file

Decrypt authenticated v2 files or compatible legacy Salted__ files.

v2 + legacy

Drop an encrypted file here or choose a file from this device

Passphrase

Create an encrypted 7z archive

Package multiple files or a folder into a standard AES-256 encrypted archive. Filenames are always encrypted.

7z · AES-256

Drop files here or choose one or more files from this device

Archive name

The .7z extension is added automatically.

Compression

Passphrase

Confirm passphrase

Use at least 12 characters. Filenames and file contents are encrypted.

Filename encryption is always enabled SecurBrowser always passes 7-Zip header encryption (-mhe=on), so filenames cannot be listed with an incorrect passphrase.

Decrypt and extract a 7z archive

Open a password-protected 7z archive locally. Extracted files can be downloaded individually or saved to a folder where the browser supports it.

7z extract

Drop a 7z archive here or choose a .7z file from this device

Passphrase

Safety guard: at most 2,000 entries, a 1 GiB archive input and 1 GiB declared uncompressed data.

Two formats, two different goals

Both operate locally. Choose authenticated native encryption or standard 7z interoperability.

🔐 Secure File

Key derivation: PBKDF2-HMAC-SHA512
Work factor: 220,000 iterations
Encryption: AES-256-GCM
Runtime: Native Web Crypto

📦 Secure Archive

Format: Standard 7z
Encryption: 7-Zip AES-256
Metadata: Headers encrypted
Runtime: Pinned sevenzip-wasm / 7-Zip 26.03

How local processing works

Secure File uses the browser's Web Crypto API. Secure Archive runs pinned sevenzip-wasm/7-Zip 26.03 WebAssembly inside a dedicated worker. The WASM assets are served from the same origin; no CDN is contacted at runtime. SecurBrowser has no upload endpoint and does not transmit selected files or passphrases.

7z archives are created with AES-256 encryption and header encryption. Unlike the custom .enc format, a generated .7z archive can be opened by compatible desktop tools without returning to this website.