Advertisement
Guide
About the AES Encrypt / Decrypt
AES (Advanced Encryption Standard) is the symmetric cipher used to protect everything from disk volumes to TLS traffic. This tool encrypts and decrypts text with a password using AES-256-GCM, an authenticated mode that guarantees both confidentiality (nobody can read the data) and integrity (nobody can tamper with it undetected). Because it's symmetric, the same password both encrypts and decrypts.
Your password isn't used as the key directly. Instead it's stretched into a strong 256-bit key with PBKDF2 and a random salt, which makes brute-forcing far harder. The output is a single Base64 blob that packs the salt, the initialization vector (IV), and the ciphertext — so all the recipient needs to decrypt is the password. Everything runs locally; nothing is uploaded.
Why the output changes every time
Encrypt the same text twice and you'll get different output — that's intentional and correct. A fresh random salt and IV are generated each time, so identical plaintext never produces identical ciphertext. This prevents attackers from spotting repeated messages. All the randomness needed for decryption travels inside the output blob.
Your password is everything
There is no backdoor and no recovery. If you forget the password, the data is unrecoverable — which is the point of strong encryption. Choose a long, unique password (the Password Generator can help), and share it with the recipient over a separate, secure channel rather than alongside the ciphertext.
How to use it
- 1Choose Encrypt, paste your text, and enter a strong password.
- 2Copy the Base64 output — it contains the salt, IV, and ciphertext.
- 3To decrypt, choose Decrypt, paste that Base64 blob, and enter the same password.
- 4Share the password with your recipient over a separate secure channel.
Frequently asked questions
Is AES-256-GCM strong enough?
Yes. AES-256 in GCM mode is a modern, widely trusted standard used across the industry. Combined with PBKDF2 key stretching, it is more than adequate for protecting text with a password.
What happens if I lose the password?
The data cannot be recovered. Strong encryption has no backdoor by design, so store the password safely — ideally in a password manager.
Why does encrypting the same text give different results?
A random salt and IV are used each time, so identical input produces different ciphertext. This is a security feature, and the values needed to decrypt are embedded in the output.
Can the recipient decrypt without any extra files?
Yes. The format version, iteration count, salt, IV and ciphertext are all packed into the one Base64 string or .enc file. They only need that and the password.
Can I encrypt a file?
Yes. Choose a file or drop it on the text box; it is encrypted in your browser and saved as name.enc. Decrypting restores the original file and its name.
How do I match another system or OpenSSL?
Use the Raw key & IV tab: pick AES-GCM, CBC or CTR, enter or generate a hex key and IV, and choose hex or Base64. For CBC the equivalent openssl command is shown, and the output matches it exactly.
Is my data or password uploaded?
No. All encryption and decryption happens in your browser via the Web Crypto API. Nothing is sent to a server.