Overview
Introduction
Sometimes hiding or pseudonymizing a CSV's contents isn't enough, you need it genuinely unreadable without a passphrase. CSV Encryptor provides real, industry-standard authenticated encryption entirely inside your browser.
It uses the same AES-256-GCM plus PBKDF2 approach as this site's AES File Encryptor/Decryptor, so the security properties are consistent and well-understood across tools.
What Is CSV Encryptor?
A CSV-specific text encryptor built on the Web Crypto API's `SubtleCrypto` interface, using AES-256-GCM (an authenticated cipher, meaning tampering is detected, not just confidentiality protected) with a key derived from your passphrase via PBKDF2.
The output is a single base64 string bundling everything decryption needs, a random salt, a random IV, and the ciphertext, so there's nothing else to keep track of besides the passphrase.
How CSV Encryptor Works
A random 16-byte salt and 12-byte IV are generated, your passphrase and the salt are run through PBKDF2 (250,000 iterations, SHA-256) to derive a 256-bit AES key, and the CSV text is encrypted with AES-GCM using that key and IV.
The salt, IV, and ciphertext (which includes GCM's built-in authentication tag) are concatenated and base64-encoded into one blob, ready to copy or download as the final output.
When To Use CSV Encryptor
Use this when you need to share or store a CSV containing sensitive data and want real confidentiality, not just obfuscation or pseudonymization.
It's also useful for encrypting a CSV before uploading it somewhere you don't fully trust, since only someone with the passphrase can ever recover the original text.
Often used alongside CSV Decryptor, CSV Anonymizer and CSV Compressor.
Features
Advantages
- Uses AES-256-GCM, an authenticated cipher, so any tampering or corruption of the encrypted blob is detected on decryption rather than silently producing garbage.
- PBKDF2 with 250,000 iterations makes brute-forcing a weak passphrase meaningfully slower than a single hash iteration would.
- Everything happens client-side via the Web Crypto API, your plaintext CSV and passphrase never leave your browser.
Limitations
- There's no passphrase recovery, forgetting it means the encrypted data is permanently unrecoverable by design.
- Encryption strength still depends on passphrase strength, a short or common passphrase remains guessable even with 250,000 PBKDF2 iterations.
Examples
Best Practices & Notes
Best Practices
- Use a long, unique passphrase, PBKDF2 slows down brute-forcing but can't turn a weak passphrase into a strong one.
- Store the passphrase somewhere separate from the encrypted blob, e.g. a password manager, never alongside the file itself.
- Verify the round trip immediately with CSV Decryptor after encrypting, before you rely on the passphrase being correct.
Developer Notes
Mirrors this site's AES File Encryptor/Decryptor exactly: PBKDF2 with 250,000 iterations and SHA-256, AES-GCM with a 256-bit key, a 16-byte salt, and a 12-byte IV, packed as `salt || iv || ciphertext` and base64-encoded in fixed-size chunks to avoid call-stack limits on large CSVs.
CSV Encryptor Use Cases
- Encrypting a CSV containing sensitive data before sharing it over an untrusted channel
- Protecting an at-rest CSV backup with a passphrase instead of relying on filesystem permissions alone
- Producing an encrypted test fixture to verify a downstream system correctly rejects or handles encrypted-looking input
Common Mistakes
- Losing the passphrase and expecting any kind of recovery, there is none by design.
- Using a short, guessable passphrase and assuming the 250,000 PBKDF2 iterations alone make it secure, strong encryption still needs a strong passphrase.
Tips
- Pair with CSV Decryptor to verify the encrypted blob decrypts correctly before deleting your only copy of the original CSV.
- If you also want the file's size reduced, compress with CSV Compressor first, then encrypt, compressing after encryption won't help since encrypted data looks random.