AES Encrypt / Decrypt

One input per line. Output is numbered to match the input order.
Pinned tools are listed in your favourites on the home page.Copies a link to this tool that carries your current input, so it opens ready to run.Gives you an iframe snippet for putting this tool on your own site.

Authenticated encryption — tampering with the ciphertext makes decryption fail rather than return garbage.

PBKDF2 key derivation (100,000 iterations, SHA-256), then the cipher you selected. The output is algorithm:salt:iv:ciphertext, so decryption needs only the password. All computation is client-side.

Ctrl+Enter Run  · Ctrl+Shift+C Copy  · Esc Clear

Understand AES Encrypt / Decrypt

Encrypts and decrypts text in your browser with AES under a password, offering AES-256-GCM (default), AES-128-GCM, AES-256-CBC, AES-128-CBC, or AES-256-CTR.

How it works

Your password is not the key. PBKDF2 stretches it into one with 100,000 iterations of HMAC-SHA-256 over a fresh 16-byte random salt, so an attacker pays that cost on every guess and a table precomputed for one salt is worthless against another. A random IV is drawn per encryption — 12 bytes for GCM, 16 for CBC and CTR — which is why encrypting the same text twice never yields the same ciphertext. The output is algorithm:salt:iv:ciphertext in base64, carrying every parameter decryption needs except the password itself.

When to use it

  • Encrypting a short secret before it passes through a ticket, a chat thread, or a shared document.
  • Producing a test vector to check that a server-side AES implementation agrees with WebCrypto.
  • Demonstrating the practical difference between an authenticated mode and an unauthenticated one.
  • Reading back something you encrypted here earlier and stored as text.
  • Interoperability-checking a legacy system that can only accept AES-CBC.

Watch out for

  • GCM detects tampering; CBC and CTR do not. With GCM, one altered ciphertext byte makes decryption fail outright. With CTR an attacker who flips a ciphertext bit flips the same plaintext bit, and CBC is the mode behind the padding-oracle attack class. Choose CBC or CTR only for interoperability, and add a separate MAC over the ciphertext when you do.
  • The password is the ceiling. 100,000 PBKDF2 iterations slow guessing by that factor but cannot rescue a weak password — a dictionary word is still found, whatever the key size. The strength of this output is the strength of what you typed.
  • Never reuse an IV or counter block with the same key. This tool generates a fresh salt and IV per encryption, so it is safe as used, but the rule matters the moment you reimplement the format: a repeated GCM nonce leaks the XOR of the two plaintexts and can expose the authentication key itself.
  • AES-256 versus AES-128 is not the decision that matters. Neither key size has a practical break; the mode and the password dominate real-world safety. Do not pick AES-256-CBC over AES-128-GCM on the strength of the larger number.

Not the right tool for: Sending a secret to someone who does not already share your password. This is symmetric encryption with no key exchange, no identity, and no forward secrecy — for that, use age, PGP, or the recipient key management your platform already provides.

Frequently Asked Questions

Which AES algorithm should I choose?

AES-256-GCM is the default and the right answer for almost every new use. GCM is authenticated, so tampering with the ciphertext makes decryption fail instead of returning garbage. Choose CBC or CTR only when a system you must interoperate with requires it — neither detects tampering on its own.

Is AES-128 less secure than AES-256?

Both are considered secure; no practical attack breaks either key size. AES-256 has a larger margin against future advances and is the conventional choice for long-lived data, while AES-128 is marginally faster. The mode you pick (GCM versus CBC) affects real-world safety far more than the key size does.

What is PBKDF2 and why is it used?

PBKDF2 (Password-Based Key Derivation Function 2) transforms a human-entered password into a cryptographic key using 100,000 iterations of HMAC-SHA256 with a random salt. The iterations make brute-force attacks 100,000× slower than hashing the password once.

Can I decrypt this output in another language?

Yes. The output is algorithm:salt:iv:ciphertext, with every parameter decryption needs. Reproduce the same PBKDF2 settings (100,000 iterations, SHA-256, the embedded salt) and the named cipher in any language, and the ciphertext decrypts identically.

How to Use AES Encrypt / Decrypt

  1. Paste or type your input in the input area above.
  2. The tool processes your input automatically or click Run.
  3. Copy or download the result using the action buttons.
  4. Use Ctrl+Enter to run quickly from the keyboard.