AES Encryption & Decryption
Encrypt and decrypt text with AES-GCM or AES-CBC using a passphrase. The salt and IV travel with the ciphertext, so nothing else has to be kept.
Input
Output (Base64)
How the passphrase becomes a key
AES needs a key of exactly 128, 192 or 256 bits, and a passphrase is neither. This tool stretches yours with PBKDF2-HMAC-SHA-256 over 250,000 iterations against a fresh random salt, which is what turns a human-typed phrase into a key an attacker cannot simply guess their way to.
There is deliberately no field for a raw hex key. Pasting a short hex string as an "AES-256 key" is the classic way to end up with far less security than the label suggests.
What the output contains
The Base64 result is `salt (16 bytes) || IV (12 or 16 bytes) || ciphertext`. Everything decryption needs, except the passphrase, travels with the message.
This matters more than it sounds: the usual reason people cannot decrypt their own data a week later is that they saved the ciphertext and forgot the IV. Here there is nothing separate to lose.
Encrypting the same text twice gives different output, because the salt and IV are new each time. That is correct behaviour, not a bug — identical ciphertext for identical plaintext is itself an information leak.
GCM or CBC
- AES-GCM — authenticated. Tampering with the ciphertext makes decryption fail rather than silently returning garbage. Use this unless something else requires otherwise.
- AES-CBC — no authentication. It will happily decrypt modified data into meaningless bytes, so it needs a separate MAC to be safe. Offered here for compatibility with systems that already use it.
Frequently asked questions
Is this safe for real secrets?
The cryptography is the browser's own Web Crypto implementation and nothing is transmitted. The weak link is the passphrase: AES-256 behind a six-character password is a six-character password. Use a generated passphrase.
Why does decryption fail without saying why?
With GCM, a wrong passphrase and tampered data are indistinguishable by design — telling them apart would leak information to an attacker. Check the passphrase, the mode and the key size.
Can I decrypt output from another tool?
Only if it uses the same layout and the same key derivation. Most tools invent their own framing, so ciphertext rarely moves between them. Text encrypted here decrypts here.
Which key size should I pick?
AES-256 unless a specification says otherwise. AES-128 is still unbroken and slightly faster, but the difference is irrelevant for text you paste into a page.