Encrypt text: where it goes, on a page or in an app

To encrypt text you can use a web page or an app, and where the text goes depends on which. Sealbox is an iPhone app, not a web page, and its site says it "has no backend". This page covers both cases and how to look at the requests yourself.

In the iPhone app you write the text, and what you send is encrypted text. The site says the channel you send it through "sees the sealed box, never your text", and the limits are listed below. On a web page, where the text goes depends on how the page was built: a form sends it to an address, and a script on the page can run cryptography itself. This page cannot say what a given site does with the text, and the sources it reads do not either.

What a web page does with text you type

A web page can receive text through a form. MDN's guide to sending form data says, about the form's action attribute: "The action attribute defines where the data gets sent." So when a form is submitted, the data it holds goes to the address the form names. This page does not say that any particular online tool works this way.

What a page can do with a script

A page can also run cryptography with a script. MDN describes the Web Crypto API as "an interface allowing a script to use cryptographic primitives in order to build systems using cryptography". The requests a page makes are the subject of the next section.

How to see which domains a page or an app contacts

Chrome's Network panel can list the requests a page makes. The Chrome DevTools documentation says: "use the Network panel when you need to make sure that resources are being downloaded or uploaded as expected". The iPhone app's own site invites both checks: "open your browser's network inspector right now" for its own pages, and, for the app, "Watch the app with iOS privacy reports or a proxy: cryptographic operations make no network requests at all." That claim is about cryptographic operations; this page does not list the other requests the app makes.

One iOS privacy report is Apple's App Privacy Report: in Settings, tap Privacy & Security, scroll down and tap App Privacy Report, then tap Turn on App Privacy Report. Apple says it "starts gathering information only after you turn it on", and that "App Network Activity shows domains that have been contacted either directly or from content within an app in the past 7 days."

Where Sealbox fits, and where it stops

It is an iPhone app (iOS 26+ at launch) where, in the site's words, you compose "before it touches any messaging app", producing "a sealed object that travels as ciphertext over any channel that can carry it". Its keys "release only to your live, currently-enrolled biometrics; a passcode is not enough". On a lost phone, even one already unlocked once, the content stays sealed, "an engineering guarantee with no known public bypass, not a formal proof", and one more layer is yours to add: "a strong alphanumeric device passcode is what still stands if the chip itself is ever broken".

The limits, in the site's words:

• Text you paste in from another app. "Whatever keyboard you used there saw it first — beyond any encryption app's reach." On dictation: "with server-based dictation, the first instant of audio may already have left".
• Metadata. "Who you talk to, when, how often, that a Sealbox box went by, and how large it is — the channel generates this; no content layer can hide it."
• A compromised, unlocked device in active use. "Malware that reads your screen as you read is beyond any encryption app — for everyone."
• Compelled secrets. "If someone can force your biometrics with the device in hand, or compel your 24-word recovery phrase, they hold the keys — and read what hasn't been read yet and whatever arrives".

Related reading:

• How to encrypt iPhone messages: iMessage, RCS, SMS
• PGP encryption: what it does and where it fits

Sources

• MDN: Sending form data — Verified on 2026-11-03
• MDN: Web Crypto API — Verified on 2026-11-03
• Chrome for Developers: Inspect network activity — Verified on 2026-11-03
• Apple Support: About App Privacy Report — Verified on 2026-11-03

Frequently asked questions

Is Sealbox an online text encryption tool?

Sealbox is an iPhone app. The site's steps begin "Open Sealbox and write in its composer", and to "iPhone only?" it answers "Yes — iOS 26+ at launch." The website, sealbox.io, keeps "no cookies, no JavaScript", and the site says "There is no Sealbox server to send data to." So you seal text in the app on your iPhone, not on the website.

Is it safe to encrypt text online?

This page cannot say, and the sources it reads do not either: it depends on how the site was built. MDN says a form's action "defines where the data gets sent", and describes the Web Crypto API as "an interface allowing a script to use cryptographic primitives". Chrome's Network panel is where you see the requests a page makes.

Where does the text go when I encrypt it with Sealbox?

The site says there is no Sealbox server to send data to. That is about Sealbox's own server: this page does not list every request the app makes. Text pasted in from another app was seen first by the keyboard used there, and with server-based dictation the first instant of audio may already have left.

What does the channel see when I send encrypted text?

The site says it "sees the sealed box, never your text", and calls the sealed box "a sealed object that travels as ciphertext over any channel that can carry it". Besides the sealed box, the channel sees the metadata listed above: who you talk to, when, how often, that a Sealbox box went by, and how large it is.