ForHosting KIT · Developer Utilities

Encrypt text

Encrypting a field before it hits your database shouldn't require pulling a full crypto library into every service that touches sensitive data. This API runs AES-256-GCM encryption and decryption against a key you supply on each call, so the operation happens correctly and the key itself never sticks around afterward.

● StableFree · in your browser

Run — free How it works & API

Use it from WebAPIEmailApp soonTelegram soon

Why AES-256-GCM specifically

AES has been the U.S. government's approved symmetric cipher since NIST selected it in 2001 as the successor to the aging DES standard, and the 256-bit key variant remains the conservative choice when data needs to stay protected for years. GCM, the Galois/Counter Mode, adds authentication on top of encryption: it doesn't just hide the data, it detects if a single bit of the ciphertext was tampered with, which is exactly the property you want for anything that gets stored or transmitted where an attacker might try to modify it undetected.

What the request and response look like

POST /dev/encrypt with your plaintext (or ciphertext, for decryption), your 256-bit key, and the operation you want. The task runs asynchronously, handing back a task_id immediately, and the result — ciphertext plus the authentication tag and nonce for encryption, or the recovered plaintext for decryption — arrives by signed webhook or a signed link valid for 24 hours.

The key never persists, by design

You bring the key on every call and it's used strictly to perform that one operation, then discarded once the task completes; it is never logged, cached or reused across requests. That matters because the entire security model of symmetric encryption collapses the moment a key leaks somewhere it shouldn't be stored, so the API is built to hold it for the shortest possible time rather than treat key custody as a feature.

Who reaches for this instead of a local library

Teams use this endpoint when a lightweight service, a serverless function, or a script written in a language without a mature crypto library needs to encrypt a field before writing it to storage, when a data pipeline needs to encrypt values consistently across services written in different languages, or when an application wants to offload the operation rather than manage cipher parameters, nonce generation and authentication tag handling correctly in-house.

What to expect on failure and delivery

A wrong key length, a missing nonce on decryption, or a tampered ciphertext that fails the GCM authentication check all return a specific, actionable error rather than a silent garbage result, and none of those failed attempts are billed. Successful tasks are automatically retried up to three times on transient errors before you'd ever see a failure at all.

What you can do with it

Encrypting fields before storage

Encrypt a sensitive value in a lightweight service before writing it to your database, without adding a crypto dependency to that service.

Cross-language pipelines

Keep encryption consistent when different stages of a data pipeline are written in different languages by centralizing the operation in one place.

Serverless and script contexts

Encrypt or decrypt a value from a short-lived function or automation script that shouldn't carry a full cryptography library.

Decrypting on read

Recover plaintext for an authorized process reading an encrypted field, with tampering automatically detected via the authentication tag.

FAQ

What encryption algorithm does this API use?

AES-256-GCM, a 256-bit symmetric cipher with built-in authentication that detects if the ciphertext was altered.

Do I need to provide my own encryption key?

Yes, you supply a 256-bit key on every request; there's no managed key storage, by design.

Do you store the encryption keys I send?

No, keys are used only to perform that single operation and are discarded immediately after, never logged or reused.

Is the encryption API free to use?

The tool above runs free in your browser. The API is paid — each call draws from your prepaid ForHosting KIT balance: top up from $10.00 (it never expires), pay each request's published price, and a call with no balance returns HTTP 402. No subscription, no tokens, and a failed task is never charged.

How much does encrypting or decrypting a value cost?

$0.002 per request for either operation, and a failed task, such as an authentication check failure, is never charged.

How do I know if a ciphertext was tampered with?

GCM's authentication tag is checked automatically on decryption, and a mismatch returns a clear error instead of corrupted plaintext.

Can I use this for bulk field encryption?

Yes, submit separate requests for each value; each is processed and billed independently at the same per-request price.

Is AES-256-GCM still considered strong enough in 2026?

Yes, it remains a widely trusted standard for symmetric encryption, provided the key is generated securely and never reused with the same nonce.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/dev/encrypt

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/dev/encrypt \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"items":["valor-1","valor-2"]}'

const res = await fetch("https://api.kit.forhosting.com/dev/encrypt", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "items": [
      "valor-1",
      "valor-2"
    ]
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/dev/encrypt",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "items": [
        "valor-1",
        "valor-2"
    ]
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev/encrypt", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"items":["valor-1","valor-2"]}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"items":["valor-1","valor-2"]}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev/encrypt", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "items": [
    "valor-1",
    "valor-2"
  ]
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "dev.encrypt",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →

Run — free