AES Encrypt / Decrypt
Encrypt or decrypt text and files with AES-GCM, CBC or CTR — the passphrase and the data never leave this device.
AES-GCM is authenticated: a wrong key, a wrong nonce or a changed byte fails instead of returning garbage.
Key size comes from the raw key's byte length.
Default 600,000. Decrypting needs the same count that encrypted the data — it is printed in the metadata below, not stored in the envelope.
PBKDF2 derives a cipher key from your passphrase — this is not password storage hashing.
AES-GCM only. Authenticated but not encrypted. AAD is not part of the envelope — supply the same bytes again to decrypt.
On a phone, use Choose file.
Encrypted output appears here.
These bytes are not text. Showing hex; use Download for the file.
| Field | Offset | Length |
|---|---|---|
| salt | 0 | 16 bytes |
| iv | 16 | 12 bytes |
| ciphertext | 28 | rest |
The AES-GCM tag is the last 16 bytes of the ciphertext, not a separate field.
Passphrases, keys, plaintext and ciphertext are never stored on this device and never sent anywhere.
A shared link carries the cipher and key settings only — never a passphrase, key, plaintext or ciphertext.
Press ? for shortcuts
Not stored between visits — this input looks credential-shaped.
Scrollable region — press Tab to focus it, then arrow keys to read.Value hidden. Use the reveal control to show it.Do it offline:$
How to use it
- Pick the direction with the Encrypt / Decrypt tabs — same page, same key cockpit, same envelope table. Encrypt starts selected.
- Choose the cipher mode. GCM is the default and the only one of the three that can tell you the key was wrong; CBC and CTR are there for interoperability and say so on screen.
- Set the key source. A passphrase is stretched with PBKDF2-HMAC-SHA256 at 600,000 iterations by default; a raw key is read as hex or Base64 and must decode to exactly 16, 24 or 32 bytes.
- Type or paste the payload, or drop a file up to 64 MB — pasted text is capped at 1 MB and the file path runs in a worker with a progress bar. GCM also accepts optional additional authenticated data.
- Read the metadata pane before you copy: iterations, salt, nonce, key size and mode are the settings the other side needs, and only the salt and nonce travel inside the envelope.
Encrypt a message or a file with AES and take away something you can read: the ciphertext, the salt and nonce that produced it, and the byte offsets they occupy. Choose GCM for output that detects tampering, or CBC and CTR when you have to match an existing system. Bring a passphrase and PBKDF2 derives the key here, or paste a raw 128-, 192- or 256-bit key. Nothing is uploaded, and no passphrase, key, plaintext or ciphertext is kept after the tab closes.
How it works
A passphrase is not a key. PBKDF2 (RFC 8018 §5.2, parameters per SP 800-132) runs HMAC-SHA256 over the passphrase and a fresh 16-byte random salt, iterating 600,000 times by default, and the 32 bytes it emits are the AES key. Change any of those three inputs — passphrase, salt, iteration count — and a different key comes out, which is why the salt travels with the ciphertext and the iteration count is printed for you to carry across.
Every encryption draws a fresh initialisation value from crypto.getRandomValues: 12 bytes for GCM, the nonce length SP 800-38D §8.2 recommends, and 16 bytes for CBC and CTR. No control lets you supply or reuse one. Repeat a GCM nonce under one key and the two keystreams cancel, exposing the authentication key itself.
GCM appends a 128-bit authentication tag to the ciphertext instead of returning it separately, so a GCM result is always 16 bytes longer than its plaintext. Decryption recomputes that tag and refuses everything if it disagrees — no partial output. CBC pads to the 16-byte AES block with PKCS#7 and CTR does not pad at all, and neither carries a tag to check.
The envelope is salt, then nonce, then ciphertext, concatenated and nothing else: 16 + 12 + n bytes for a GCM passphrase run, 12 + n with a raw key, 16 more for CBC and CTR's larger block. Additional authenticated data stays outside it. The layout table beside the output is generated from the same function that packs the bytes.
Examples
Meet me at the docks at 19:00.x+8VVfAZ3FKXqR+w6uuY9RqqNG6hDCel+w7qJgZ90YTRgTs2SI5UTAMuVPOSbT1muU4HJFB52qBqMLpF7F/rErRH6jb1QgdoDZk=One real run with the passphrase correct horse battery staple at 600,000 iterations. Thirty plaintext bytes became a 74-byte envelope: 16 salt, 12 nonce, 46 ciphertext — 30 plus the 16-byte tag. Salt c7ef1555f019dc5297a91fb0eaeb98f5 and nonce 1aaa346ea10c27a5fb0eea26 are the first 28 bytes of what you copied, so the receiver needs only the passphrase and the iteration count.
zPWgECZfrkTCpAdG0ZnWlzN+LA4gI0nwQho7V1fwfzK24ePBduJmngW0An8QBrcPiBk81wOAdQb9wjyG5IsDgnMBl3IIVEqCThe quick brown fox jumps over the lazy dog.The same envelope decrypted with a raw key instead of a passphrase, so there is no salt to skip: nonce first, ciphertext second. The verdict reads Authenticated because the tag verified, and a chip records that 32 decoded key bytes selected AES-256 — nobody typed the key size.
(empty plaintext) · AES-GCM · raw 256-bit keyudGlOFS4JW8OteqA9uBfsnNBYfzOGRmc4HeW8g==Encrypting nothing still produces 28 bytes: a 12-byte nonce and a ciphertext that is the 16-byte tag alone. Drop a 0-byte file and a note says exactly that, rather than leaving you to wonder where output came from. The same envelope in CTR mode would be 16 bytes, because CTR's counter block is a full 16-byte AES block and it emits no tag and no padding.
000102030405060708090a0b0c0d0e0fb869fd111012ebe28a990efc3a578b8b82af58b67f30708cce4edec8799324The honest failure. This CBC envelope holds attack at dawn, and the key here is the wrong one — yet the padding check passed by coincidence and fifteen bytes of garbage came out with no error at all. The verdict reads Unverified and quotes the reason: CBC and CTR cannot detect a wrong key or tampering.
Every example on this page is executed against the same engine that powers the tool, on every build.
Gotchas worth knowing
There is no way to reuse a GCM nonce
Each encryption draws its own 12 random bytes and no field accepts one you supply. That closes the worst GCM failure by construction: two messages encrypted under one key and one nonce leak the XOR of their plaintexts and expose the tag-generation key. Decrypt reads the nonce out of the envelope, so nothing is lost by not offering the control.
CBC always adds padding, even on a perfect fit
PKCS#7 pads to the next 16-byte boundary, and when the plaintext is already a multiple of 16 it appends a whole extra block of sixteen 0x10 bytes so the unpadding step is never ambiguous. Sixty-four plaintext bytes therefore leave as 80 of ciphertext. CTR pads nothing: 65 bytes in, 65 bytes out.
CTR counter width is an interop parameter, not a preference
This tool runs AES-CTR with a 64-bit counter field inside the 16-byte counter block. Other implementations use 32 or 128 bits, and a mismatch produces plausible-looking garbage past the first few blocks with no error raised, because CTR has nothing to check against. If a CTR value from elsewhere decodes to nonsense, compare counter widths before you suspect the key.
AES-192 is offered, then probed
A 24-byte raw key selects AES-192 and the mode row accepts it, but WebCrypto support for 192-bit keys is uneven across browsers. Rather than crash, the run asks the platform first and, if the answer is no, returns a typed refusal naming the key size. Where you get to choose, 128 and 256 are the safe pair.
Additional authenticated data is not stored for you
AAD is authenticated by GCM but not encrypted and not written into the envelope — it is capped at 4 KB and it is yours to keep. Decrypting without it, or with one byte different, fails the tag check exactly like a wrong key, and the refusal cannot distinguish the two cases. Record the AAD wherever you record the iteration count.
Common errors
Raw key decodes to 15 bytes — AES keys are exactly 16, 24 or 32 bytes (128, 192 or 256 bits). Check the key encoding, or switch the key source to a passphrase.- Usually the encoding selector, not the key: 32 hex characters are 16 bytes, while the same 32 characters read as Base64 are 24. The decoded byte count is printed so you can see which reading you got.
Wrong key, wrong IV, wrong iteration count, or tampered data — AES-GCM authentication failed. Nothing is decrypted when the tag does not verify.- GCM's refusal is all-or-nothing and it cannot say which of the four causes applied. Check the iteration count first — it is the one input that does not travel inside the envelope, and a passphrase stretched 210,000 times gives a different key from the same passphrase stretched 600,000 times.
AES-CBC decryption stopped at the PKCS#7 padding check — the key, the IV or the iteration count is wrong, or the ciphertext was altered. CBC cannot tell you which.- The padding check is not authentication; it is the last byte pattern happening not to look like padding. With a wrong key it catches roughly 2,037 attempts in 2,048 and silently passes the rest.
AES-CBC ciphertext is 31 bytes, which is not a multiple of the 16-byte AES block — CBC output is always block-aligned, so part of the value is missing or an extra character crept in.- Raised before any key is derived, so it costs nothing. A truncated copy is the usual cause; a Base64 value that lost its trailing padding characters is the next.
PBKDF2 iterations must be a whole number from 1,000 to 5,000,000 — this run asked for 500. Use 600,000 unless you are matching another tool's setting.- The floor exists so a typo cannot quietly produce a weak key, and the ceiling so the tab cannot be locked up for minutes. Anything below 600,000 still runs and carries a note saying what it is.
File is 67,108,865 bytes, larger than the 64 MB limit for this tool — the whole file is encrypted in memory here, so bigger files are refused instead of failing partway.- The cap is checked from the file's size before a byte is read, so an oversized drop is refused immediately rather than after a long read. Text pasted into the pane has its own, smaller 1 MB cap.
FAQ
Which mode should I choose?
GCM, unless something on the other side requires otherwise. It is the only one of the three that verifies what it decrypts, so a wrong key or an altered byte produces a refusal instead of plausible rubbish. Choose CBC or CTR when you are decrypting something that already exists in that shape.
Can this open a file encrypted by openssl enc or 7-Zip?
No. Those tools write their own container formats — OpenSSL prefixes Salted__ and its own salt, archivers add headers of their own — and this page reads exactly one layout: salt, then nonce, then ciphertext, with nothing in front. That is also why no command-line equivalent is printed here. PGP messages and public-key encryption are outside this page too: for exchanging a key with someone else's public key, see RSA Encrypt / Decrypt.
Why does the iteration count have to be sent separately?
Because putting it in the envelope would mean inventing a header format, and then this page would produce a blob only this page could read. The count is shown in the metadata pane and typed back on the decrypt side; the salt and nonce, which have fixed lengths, are the only things carried in the bytes.
Is PBKDF2 here the same thing as password hashing?
No, and the distinction matters. Here PBKDF2 turns a passphrase into cipher key material that must be reproducible byte-for-byte to get your data back. Storing credentials for later verification is a different job with different tools — see /bcrypt-generator and /argon2-generator, which produce verifier strings rather than keys.
How often does a wrong CBC key fail silently?
Measured on this engine: 11 of 2,048 wrong-key trials produced output with no error at all, about 1 in 186. The other 2,037 hit the padding check. The fourth example above is one of those 11, kept as a fixture so the number on this page stays honest.
What leaves this device when I encrypt something?
Nothing. The passphrase, the key, the payload and the result stay in the page; a dropped file is read locally and a download is built from bytes already in memory. Share links carry the mode and option settings only — no key, no salt, no ciphertext — and secret fields are not restored between visits.
Keyboard shortcuts
- ⌘/Ctrl + Enter
- Runs whichever tab is open — the encrypt side or the decrypt side.
- ⌘/Ctrl + S
- Saves the output bytes as a file instead of saving the page.
- ⌘/Ctrl + C
- With nothing selected and focus in the tool, takes the output pane; the passphrase and the key are never copied.
- ⌘/Ctrl + Shift + C
- Takes that output even while something else on the page is selected.
- s
- Switches between Encrypt and Decrypt, unless the cursor is in a field.
- ? or ⌘/Ctrl + /
- Opens the overlay listing these bindings.