AES Encryption / Decryption
Encrypt and decrypt text with AES-GCM or AES-CBC using your own key. All cryptographic operations run locally in your browser.
Input
Format
Ciphertext output format: salt(16).iv(12).ct(base64) all base64-encoded in one blob. For CBC, IV is 16 bytes. For GCM, IV is 12 bytes and includes authentication tag.
⚠️ Important
- Do not encrypt production secrets in a web form.
- PBKDF2 iterations: 100,000 (strong, but slow on weak devices).
- This tool is for education and quick experiments. Use a real KMS for production.
About AES Encryption / Decryption
AES (Advanced Encryption Standard) is a symmetric block cipher used worldwide to encrypt data with a shared secret key. This tool supports two modes: AES-GCM, which adds authentication so any tampering is detected, and AES-CBC, which encrypts without authentication and should not be used with untrusted data. A passphrase is stretched into the actual encryption key using PBKDF2-SHA256.
Use this tool when you need a quick client-side encryption experiment or want to see how AES modes behave with real inputs. Do not use it to process production keys — a web form is not a secure key-management environment. Prefer AES-GCM over CBC whenever possible, and keep passphrases long and unique, since PBKDF2 slows down but never fully prevents offline guessing.
GCM versus CBC, and what actually protects you
GCM is a counter-mode cipher that produces ciphertext plus a 128-bit authentication tag computed over the ciphertext and any additional authenticated data. Web Crypto appends that tag to the ciphertext, so flipping one bit of the stored blob makes `decrypt` reject it outright instead of returning garbage. This page passes no AAD, so it authenticates the ciphertext and nothing else — you cannot bind the plaintext to a version number, a record ID, or a filename.
CBC is only encryption. Each block is XORed with the previous ciphertext block, and Web Crypto adds PKCS#7 padding on the way out and validates it on the way in. That padding check is not authentication: a wrong key occasionally produces valid padding by chance, and you get plausible-looking plaintext with no error. Every encryption run here draws a fresh 16-byte salt and a fresh IV from `crypto.getRandomValues`, which is the minimum you owe CBC.
What PBKDF2 is doing to your passphrase
There is no raw-key field on this page: the encryption key is always derived. `deriveKey` runs PBKDF2-HMAC-SHA256 with 100,000 iterations over a 16-byte random salt, both hardcoded in the source rather than exposed as options, then hands the result to Web Crypto as an AES-GCM or AES-CBC key of the size you selected. That is why the blob is self-contained — salt, IV and ciphertext travel together, so the same passphrase reproduces the same key.
The layout is `salt(16) || iv(12 or 16) || ciphertext`, base64-encoded as one blob. The salt is why encrypting the same text twice yields different output, which is why you must keep it if you store only part of the blob. Note that mode and key size live in the UI rather than the blob, so re-select both when decrypting or the failure message stays generic.
Limits worth knowing before you build on this
The single most important rule in GCM is that a nonce must never repeat under the same key. Reusing one lets an attacker recover the authentication subkey and XOR two plaintexts to read their difference. This page generates a fresh IV per click so it cannot happen here — but if you copy this blob format into your own code and derive the IV from a counter or a timestamp, you are one bug away from catastrophe. The nonce must be unique; it does not need to be secret.
Beyond that: the input is a single string in memory, encrypted in one `crypto.subtle` call, so there is no streaming path for large payloads — and a web form is not a key management system. PBKDF2 at 100,000 iterations is a reasonable floor in 2026, but it is still a general-purpose KDF with a fixed work factor. To derive keys from human-chosen passphrases, prefer Argon2id or scrypt with a tunable cost.
Frequently Asked Questions
How do I encrypt with AES?
Is AES encryption secure?
Is my data sent to a server?
Do I need an account or API key?
Can I use these tools offline?
All processing happens in your browser. No uploads, no tracking, no servers. Your API keys, configs, and private payloads stay private — 100% client-side.