AES Encryption & Decryption

AES (Advanced Encryption Standard) is the industry-standard symmetric encryption algorithm used worldwide to protect sensitive data. AES-GCM (Galois/Counter Mode) provides both confidentiality and authenticity in a single operation. This tool encrypts and decrypts text using AES-256-GCM entirely in your browser via the Web Crypto API - no data ever leaves your machine.

AES-256-GCMPBKDF2 Key Derivation100,000 iterations

Password

11 chars (fair)

Plaintext

14 characters

How It Works

Encryption Process:

A random 16-byte salt and 12-byte IV are generated
Your password is fed into PBKDF2 with the salt (100,000 iterations, SHA-256) to derive a 256-bit AES key
The plaintext is encrypted using AES-256-GCM with the derived key and IV
The output is Base64(salt + IV + ciphertext + auth_tag)

Decryption Process:

The Base64 string is decoded, and the salt, IV, and ciphertext are extracted
PBKDF2 re-derives the same AES key from your password and the extracted salt
AES-GCM decrypts and authenticates the ciphertext
If the password is wrong or data was tampered with, decryption fails with an error

Security Notes

All encryption and decryption happens locally in your browser. No data is sent to any server.
AES-GCM provides both confidentiality and integrity (authenticated encryption).
Each encryption produces a different output due to random salt and IV, even with the same password and plaintext.
Use a strong, unique password. The security of the encryption depends entirely on the password strength.

How to Use AES Encryption / Decryption

To encrypt: enter your plaintext message and a strong password or passphrase. The tool derives a 256-bit AES key from your password using PBKDF2 with a random salt and 100,000 iterations. Click 'Encrypt' to produce a Base64-encoded ciphertext that includes the salt, initialization vector (IV), and authentication tag. To decrypt: paste the encrypted output and enter the same password. The tool extracts the embedded salt and IV, re-derives the key, and decrypts the ciphertext. If the password is wrong or the data has been tampered with, decryption fails with an authentication error.

Common Use Cases

AES encryption is used for securely sharing sensitive information like passwords and API keys with colleagues, encrypting configuration files and environment variables before committing to version control, protecting personal notes and documents stored in cloud services, encrypting data before transmitting over insecure channels, creating self-contained encrypted messages for email or chat, and testing encryption workflows during application development without needing a backend server.

Technical Details

AES-GCM is an authenticated encryption mode that provides both confidentiality (encryption) and integrity (authentication tag). The tool uses the Web Crypto API (crypto.subtle) for all cryptographic operations, ensuring native performance and security. Key derivation uses PBKDF2 with SHA-256, a 16-byte random salt, and 100,000 iterations to convert the password into a 256-bit AES key. Each encryption generates a unique 12-byte initialization vector (IV). The output bundles salt + IV + ciphertext + auth tag into a single Base64 string for easy transport.

Frequently Asked Questions

AES-GCM (Advanced Encryption Standard in Galois/Counter Mode) is an authenticated encryption algorithm that simultaneously encrypts data and produces an authentication tag. This means it protects both the confidentiality of your data and verifies that it has not been modified. AES-256-GCM uses a 256-bit key, providing 2^256 possible key combinations.

Yes, when using the Web Crypto API. This tool uses the browser's native crypto.subtle interface, which runs cryptographic operations in a secure, sandboxed environment. No data is transmitted to any server. However, always ensure you are using HTTPS and trust the website serving the tool.

There is no way to recover encrypted data without the original password. AES encryption is designed so that the ciphertext is computationally impossible to decrypt without the correct key. Always store your passwords securely using a password manager.