Encrypting a message takes one click. Everything that actually determines whether it stays private happens around that click: how you choose the password, how you get it to the other person, and what you do afterwards. This guide is about those parts, because that is where encrypted messages get broken in practice β almost never by breaking the cipher.
Choosing a password worth using
With password-based PGP, your passphrase is the key. AES-256 is not going to be broken; a password that appears in a wordlist absolutely will be. Anyone who obtains the ciphertext can attack it offline, at their own pace, with no rate limiting.
What works
Four or five unrelated words is the most practical advice for something you have to say out loud over the phone β correct-battery-mountain-teapot is both stronger and easier to transmit than P@ssw0rd!. If you do not need to dictate it, a password manager's generated string is better still.
What does not
Anything you have used elsewhere. Anything derived from the recipient's name, the project, the date, or the subject of the message β that is the first thing an attacker who knows the context will try. Substituting 3 for e does not help; the wordlists have accounted for that for twenty years.
CrypClip enforces an eight-character minimum and shows a strength meter, but treat both as a floor rather than a target.
Use a second channel for the password
This is the rule that matters most, and it is the one most often broken.
If you email the encrypted message and then email the password, you have gained very little. Anyone who can read one email can almost certainly read the other. The same is true of two messages in the same chat thread, or a link and a password in the same ticket comment.
Send the message one way and the password another: message by email, password by phone call or SMS. Message by chat, password in person. The goal is that no single compromised account or intercepted channel yields both halves.
Where practical, say the password out loud rather than typing it anywhere. It is the only channel that leaves no copy.
What a share link does and does not hide
CrypClip's share link puts the encrypted message after the # in the URL. Browsers never send that part to the web server, so the ciphertext does not reach crypclip.com β we could not read your messages even if we wanted to, and that is verifiable.
But be clear about what that guarantee covers. The moment you paste that link into a chat app, an email, or a ticket, that service receives the encrypted message. It is still encrypted, and still useless without the password β but it is now sitting in someone else's logs, where it can be attacked offline at leisure.
This is precisely why the password strength above matters more than it seems. Assume the ciphertext will be retained somewhere forever, and choose accordingly.
Afterwards
Encrypted messages have a habit of outliving their usefulness. A credential you sent last year is still sitting in a thread, still encrypted with a password you also still use.
Two habits help. Rotate whatever you sent once it has been received and used β a shared credential should not have the same lifetime as the message that delivered it. And do not reuse the password across messages: one compromised passphrase should decrypt exactly one thing.
What none of this protects
Encryption secures a message between two endpoints. It does nothing about the endpoints themselves.
If either device is compromised, the message is readable before encryption and after decryption regardless of the cipher. If the recipient forwards the decrypted text into a group chat, no amount of AES helps. And encryption conceals content, not metadata β the fact that you sent something, when, and to whom, is still visible.
If your threat model includes a determined, well-resourced adversary targeting you specifically, a browser-based tool is not the right foundation. Our comparison with GnuPG covers where that line sits.
Short checklist
- Password is four or more unrelated words, or generated β and unique to this message.
- Password travels on a different channel from the message.
- Nothing in the password can be guessed from the message's context.
- Whatever you sent gets rotated once it has been used.
- You have accepted that the ciphertext may be stored indefinitely wherever you sent it.
Ready? Encrypt a message, or read the step-by-step walkthrough first.