Tax documents carry your Social Security number, income, and bank details, so they should never travel as plain email attachments. Here, your files are locked with a password on your own phone or computer first. Only the locked package is emailed — anyone who intercepts it sees scrambled data, not your documents.
W-2s, 1099s, a photo of your ID, last year’s return — PDFs and clear phone photos work best. Files stay on this device until you encrypt them.
Drag & drop files here
or
This password locks the package. The EsignTax office can only open it with this exact password — there is no reset and no back door.
Use a passphrase you can share easily — for example, three or four words plus a number.
Share the password separately — never in the same email as the package. You can share it by phone, text message, WhatsApp, in person, or in a separate email. If the password travels with the package, the lock does no good. And if the password is lost, the package cannot be opened — by anyone, including us.
Encryption happens here, on your device. You’ll get one locked file ending in .esigntax — that file, and only that file, is what gets emailed.
Some browsers and in-app windows block the email and share buttons. This way always works:
kimcpa@esigntax.com
Select the .esigntax file the client emailed to kimcpa@esigntax.com and enter the password they shared with you separately — by phone, text message, WhatsApp, in person, or a separate email. Decryption happens on this device — the package is never uploaded anywhere.
Drag & drop the .esigntax package here
or
The same approach banks and password managers use — run entirely in your browser, with no account and nothing installed.
Your password is stretched into a strong encryption key and your files are sealed with AES-256 — before anything is sent anywhere. The originals never leave your phone or computer unencrypted.
The .esigntax package is what you attach to the email to kimcpa@esigntax.com. If it’s forwarded, intercepted, or lands in the wrong inbox, it opens for no one without the password — not even the file names are visible.
You share the password with the office separately — by phone, text message, WhatsApp, in person, or a separate email, never in the same email as the package. They unlock the package on their own computer with this same page. Wrong password? The package refuses to open — that’s the encryption checking its own seal.
Send what applies to you — when in doubt, include it. One package can hold everything.
For anyone who wants to check the lock before trusting it.
| Encryption | AES-256-GCM (authenticated encryption — tampering is detected) |
|---|---|
| Key derivation | PBKDF2 with SHA-256, 600,000 iterations, fresh random salt per package |
| Engine | Web Crypto API, built into your browser — no uploads, no accounts, no third-party server |
| What’s inside the package | Only scrambled data. File names, your name, and contents stay sealed until the password unlocks them |
| Password handling | Used only in this page, on this device, to build the key. Never transmitted, never stored |
| Delivery | Your own email, to kimcpa@esigntax.com. Keep the package under about 25 MB so it can be attached |