Encrypt files with openssl enc (AES-256 + PBKDF2)
Password-protect any file with strong AES encryption before uploading or emailing it.
Encrypt with openssl enc -aes-256-cbc -pbkdf2 -in secret.txt -out secret.txt.enc and decrypt the same way plus -d.
01Command
Command
$ openssl enc -aes-256-cbc -pbkdf2 -in secret.txt -out secret.txt.enc02What it does
openssl enc applies a symmetric cipher directly to a file: -aes-256-cbc selects AES-256 in CBC mode, and -pbkdf2 stretches your passphrase into a proper key so brute-forcing is expensive. Omitting -pbkdf2 falls back to the obsolete legacy derivation, which old files may still use but new ones should not. Add -a to produce base64 output when the encrypted blob must travel inside email or text.
03Risk
!Warning: This is a manual, no-metadata format — there is no integrity check by default, so consider -aes-256-gcm or signing the file separately. If you forget the passphrase the data is gone for good, and anyone who sees the command line (shell history, ps) learns nothing but the cipher, never the password itself.
04Undo
Undo
$ openssl enc -d -aes-256-cbc -pbkdf2 -in secret.txt.enc -out secret.txt05Sources
- openssl-enc(1ssl) — Debian bookwormEvidence: Documents 'openssl enc' with cipher names like aes-256-cbc, the -pbkdf2 key-derivation option and -d for decryption, with matching encrypt/decrypt examples.
- openssl-enc(1) — Arch Manual PagesEvidence: Same enc command documented, warning that the default digest/key derivation is deprecated and recommending -pbkdf2.
Last verified: 2026-09-19 · Category: Security & Privacy