AES Encryption and Decryption Online

Encrypt and decrypt text with AES-256-GCM or AES-CBC using a password (PBKDF2, 600,000 iterations) or a raw key. Works with openssl enc -pbkdf2 output too.

The interactive tool loads here when JavaScript runs.

About this tool

What is the AES Encryption Tool?

Type a message and a password, and this tool encrypts it with AES-256-GCM and gives you one Base64 string to store or send. Paste that string back with the same password and you get the message. Behind the scenes the password is stretched into a 256-bit key with PBKDF2-HMAC-SHA256 over 600,000 iterations and a random 16-byte salt, and every encryption uses a fresh random 12-byte IV, so the same text never encrypts to the same output twice.

Three key sources cover the usual situations. Password mode is for people. Raw key mode takes a 128, 192 or 256-bit key in hex or Base64, for developers testing code that already has a key. OpenSSL mode reads and writes the format of openssl enc -aes-256-cbc -pbkdf2 -a, so you can decrypt something a colleague encrypted on the command line or produce text they can decrypt there. CBC mode is available for compatibility; GCM is the default because it also detects tampering.

Encryption happens in your browser with the Web Crypto API. Neither the text, the password nor the key is sent anywhere.

  • AES-256-GCM (authenticated) and AES-CBC with PKCS#7 padding
  • Password mode with PBKDF2-HMAC-SHA256, random salt and stated iterations
  • Raw 128, 192 or 256-bit keys in hex or Base64, with a key generator
  • OpenSSL enc -pbkdf2 compatible input and output
  • Compact Base64 or self-describing JSON bundle
  • Salt, IV, ciphertext and tag shown separately in hex
  • Checked against NIST GCM and CBC test vectors
Read the guide: AES-GCM vs AES-CBC: Encrypting Text with a Password Properly

How to use the AES Encryption Tool

  1. Choose Encrypt or Decrypt.
  2. Pick the key source: Password, Raw key, or OpenSSL enc for compatibility with the command line.
  3. Choose AES-GCM (recommended) or AES-CBC, and keep the iteration count unless you know the other side uses a different one.
  4. Enter the password or key and the text. The encrypted output appears below and refreshes as you type.
  5. Copy or download the result. Press "Test decrypting it" to check the round trip before you rely on it.

Worked examples

Password, AES-256-GCM, compact output

Input

Text "abc", password "pw"

Output

Base64 of 16-byte salt + 12-byte IV + 3-byte ciphertext + 16-byte tag (47 bytes, 64 Base64 characters)

GCM adds no padding, so the ciphertext is as long as the text, plus 44 bytes of overhead for salt, IV and tag.

Decrypting OpenSSL output

Input

U2FsdGVkX18BAgMEBQYHCAasjjrdVJoSaHOk81PBW6s= with password "secret", OpenSSL mode, 10,000 iterations

Output

hello

Made with printf hello | openssl enc -aes-256-cbc -pbkdf2 -a -pass pass:secret -S 0102030405060708. The salt is in bytes 9 to 16.

A wrong password

Input

GCM output decrypted with a different password

Output

Decryption failed: the authentication tag does not match

GCM refuses to return anything. CBC may instead report bad padding, or occasionally return garbage, which is why GCM is preferred.

Background and insight

AES, the Advanced Encryption Standard, is the Rijndael block cipher standardised by NIST in FIPS 197 (2001). It encrypts 16-byte blocks with a 128, 192 or 256-bit key. A mode of operation turns the block cipher into something that handles messages of any length. CBC (NIST SP 800-38A) chains blocks together and needs padding; Web Crypto uses PKCS#7. GCM (NIST SP 800-38D) runs AES as a counter-mode stream and adds a 128-bit authentication tag computed with GHASH, so any change to the ciphertext or a wrong key makes decryption fail instead of returning garbage.

GCM has one hard rule: never reuse a 12-byte IV with the same key, because two messages under the same key and IV leak their XOR and allow forgeries. Random IVs are safe for up to about 2^32 messages per key, which NIST SP 800-38D sets as the limit. In password mode every message also gets a new salt, so the key itself changes each time.

A password is not a key. PBKDF2 (RFC 8018) runs HMAC-SHA256 many times so each guess costs an attacker the same work. The OWASP Password Storage Cheat Sheet recommends 600,000 iterations for PBKDF2-HMAC-SHA256; the iteration count is part of the output settings and decryption must use the same number. OpenSSL's -pbkdf2 option defaults to 10,000 iterations and derives both key and IV from the password and an 8-byte salt, written after the 8 bytes "Salted__", which is why its Base64 always begins U2FsdGVkX1.

Common use cases

  • Sending a secret by another channel

    Encrypt a short note, send the Base64 by email or chat, and give the password by phone.

  • Testing application crypto

    Check that your backend's AES-GCM output, with a known key and IV layout, decrypts here and vice versa.

  • Working with openssl enc files

    Decrypt text a script produced with openssl enc -pbkdf2 -a, or produce text a script can decrypt.

  • Teaching cipher modes

    See salt, IV, ciphertext and tag separately and how the output changes on every run.

Tips and limitations

  • The password is the weak link. Use a long random passphrase; 600,000 PBKDF2 iterations slow guessing down but cannot save "summer2024".
  • Keep the settings with the ciphertext. Compact output needs the same mode, key source and iteration count to decrypt; the JSON bundle records them for you.
  • Never reuse an IV with the same raw key in GCM. This tool always picks a random one; if you supply your own in code, use a counter or 12 random bytes.
  • Chrome and Edge do not support 192-bit AES keys in Web Crypto. Use 128 or 256 bits.
  • OpenSSL text must be decrypted with -a -A when it is on one line, as this tool outputs it.
  • This is for text. For files, use a dedicated tool such as age, 7-Zip with AES-256, or your operating system's disk encryption.

Frequently asked questions

Should I use AES-GCM or AES-CBC?

Use GCM unless something forces CBC. GCM encrypts and authenticates in one step, so tampering and wrong keys are detected. CBC only provides confidentiality and needs a separate HMAC to be safe against modification and padding-oracle attacks.

Is AES-128 secure enough or do I need AES-256?

AES-128 has no practical attack and is fine for most uses. AES-256 gives a larger margin, including against future quantum search, and costs little extra. In password mode this tool always derives a 256-bit key.

What is the IV and does it need to be secret?

The initialisation vector makes each encryption unique so equal messages do not produce equal ciphertexts. It does not need to be secret and is stored next to the ciphertext, but it must not repeat with the same key, and for CBC it must be unpredictable.

Why does decryption say bad decrypt or the tag does not match?

The password or key is wrong, a setting differs (mode, iteration count, key source), or the Base64 was truncated or edited. For OpenSSL text, check the -iter value used to encrypt; OpenSSL defaults to 10,000.

How many PBKDF2 iterations should I use?

OWASP recommends 600,000 for PBKDF2-HMAC-SHA256, which is this tool's default. More iterations slow down both you and an attacker equally, so the strength of the password still matters more.

Can I decrypt this output in Python or Node?

Yes. Split the compact Base64 into salt (16 bytes), IV (12) and the rest, derive the key with PBKDF2-SHA256, then decrypt with AES-GCM where the last 16 bytes are the tag. The JSON bundle gives each part separately to make that easier.

Is my text sent to a server?

No. The tool uses the Web Crypto API built into your browser, and the page makes no request when you encrypt or decrypt.

Is there an in-depth guide to the AES Encryption Tool?

Yes. “AES-GCM vs AES-CBC: Encrypting Text with a Password Properly” covers the background, how it works, common pitfalls and worked examples. Read the full guide.

People also search for

  • encrypt text with password aes 256
  • aes gcm vs cbc which to use
  • decrypt openssl enc base64 online
  • what is an iv in aes encryption
  • pbkdf2 iterations for aes key
  • aes 128 vs aes 256 security
  • why does aes decryption fail bad decrypt
  • aes encryption with salt and iv format

Related Tools You May Like

Free, in-browser tools that pair well with this one.