Skip to content

AES Encrypt / Decrypt

In-browser only NIST FIPS 197 Web Crypto API

Input

0 bytes · UTF-8 text · max 1 MB
Drop a file here, or choose one to encrypt or decrypt

Files always use AES-GCM, whatever mode is selected for text.

Output

All encryption runs in your browser. Your data, keys, and IVs never leave your device.

Your result will appear here

Enter your data, review the configuration, then run the encryption or decryption.

Live mode is off above 100,000 PBKDF2 iterations — each run would be too slow.
Advanced
Mode

Authenticated encryption with additional data — recommended for most use cases.

Key size
Output format

12 bytes (96-bit nonce) · Use a unique IV for every encryption with the same key.

Authentication tag length

PBKDF2 key derivation

Default is 600,000 iterations (OWASP guidance for PBKDF2-HMAC-SHA256). Lower values derive faster but are easier to brute-force.

Derived key (hex)
Security notes
Mode security

AES-GCM provides both encryption and authentication — it can detect tampering. CBC and CTR provide confidentiality only; integrity must be verified separately. ECB is deterministic and leaks patterns — avoid it.

IV security

A unique IV must be used for every encryption with the same key. Reusing an IV with GCM can completely break security. This tool auto-generates a cryptographically random IV.

Passphrase derivation

PBKDF2 derives a cryptographic key from your passphrase using a random salt and many iterations, making brute-force attacks expensive. To decrypt later you need the same passphrase plus the salt and iteration count — the tm1 bundle already stores the salt and iterations for you.
Related tools View all

Overview

AES-256 encryption and decryption online — GCM, CBC, OpenSSL and CryptoJS

Encrypt and decrypt text or files with AES-GCM, CBC, CTR, or ECB. Use a passphrase (PBKDF2, 600,000 iterations by default) or a raw key, switch to an OpenSSL or CryptoJS preset to read existing ciphertext, and keep everything in your browser — keys, IVs, and plaintext never leave your device.

  • AES-GCM, CBC, CTR, and ECB modes
  • 128, 192, and 256-bit key sizes
  • Passphrase (PBKDF2, 600,000 iterations by default), Hex, or Base64 key input
  • OpenSSL and CryptoJS presets for decrypting existing ciphertext
  • Self-contained tm1 bundle that carries mode, salt, IV, and tag
  • File encryption and decryption without uploading the file
  • Copy-ready code snippets, live mode, and fullscreen workspace
  • Built-in NIST known-answer self-test
  • All encryption runs entirely in your browser
  • Keys, IVs, and plaintext never leave your device
  • Uses the Web Crypto API — a browser-native cryptographic library
  • Encrypt sensitive notes before pasting them into a document or chat
  • Share a small encrypted payload with someone who has the passphrase
  • Learn how AES modes, IVs, and PBKDF2 behave interactively
  • Generate known-answer test vectors to validate another implementation
  • Verify ciphertext interop against command-line tools like openssl

Guide

How to Use

  1. 1
    Choose your encryption mode

    The tool defaults to AES-GCM, which provides both encryption and authentication. Switch to CBC, CTR, or ECB if your use case requires it.

  2. 2
    Enter your passphrase or key

    Type a passphrase and the tool derives an AES key with PBKDF2. Or switch to Hex / Base64 format and paste a raw key of the exact required length.

  3. 3
    Enter the text to encrypt or decrypt

    Paste or type your message into the input area. For decryption, paste the ciphertext in the format it was produced (Base64 or Hex).

  4. 4
    Click Encrypt or Decrypt

    All processing happens in your browser — your data never leaves your device. The result appears instantly in the Output panel on the right.

  5. 5
    Copy your results

    Use the copy button next to each output field, or copy the tm1 bundle, which packs the ciphertext, IV, auth tag (GCM), and salt (passphrase) into one string. Without the bundle you need every one of those values to decrypt later.

Reference

AES Mode Comparison

Mode Security Authentication Padding IV bytes
AES-GCM Recommended Yes (AEAD) None needed 12
AES-CBC Acceptable No PKCS7 16
AES-CTR Acceptable No None needed 16
AES-ECB Not recommended No PKCS7 None

Reference

Compatibility with OpenSSL, CryptoJS, and other languages

AES is a standard, so ciphertext made here can be read elsewhere — as long as every parameter matches. Pick a preset to load the matching defaults.

  • OpenSSL (enc)

    The OpenSSL preset targets the "Salted__" format of openssl enc -aes-256-cbc -pbkdf2 -a. Match the iteration count and digest used on the command line (OpenSSL defaults to 10,000 iterations with SHA-256).

  • CryptoJS

    The CryptoJS preset decrypts strings that start with U2FsdGVkX1 — the Base64 of "Salted__" — produced by CryptoJS.AES.encrypt(text, passphrase). Legacy CryptoJS derives its key with MD5-based EVP_BytesToKey, which is weaker than PBKDF2; use it only to read existing data.

  • Web Crypto, Node.js, Python, Java

    With a raw key, a known IV, and AES-GCM, the output interoperates with crypto.subtle, Node.js crypto, Python cryptography, and Java javax.crypto. Some libraries expect the auth tag appended to the ciphertext — this tool shows it separately. Use the code snippet panel to copy a matching example.

  • tm1 bundle

    The tm1 bundle is a Tool Matic format for moving a message between two people who both use this page. For other software, copy the ciphertext, IV, tag, and salt separately.

Guide

Troubleshooting decryption errors

  • Authentication tag verification failed (GCM)

    The key or passphrase is wrong, the IV or AAD differs, or the ciphertext was modified. Re-enter the exact values used to encrypt. In GCM a failed tag means the data cannot be trusted.

  • Bad padding or garbage output (CBC)

    CBC has no authentication, so a wrong key often produces padding errors or unreadable bytes. Check the key size, IV, padding mode, and whether the ciphertext is Base64 or Hex.

  • Ciphertext starts with U2FsdGVkX1

    It was made by CryptoJS or OpenSSL with a salt. Switch the preset to CryptoJS or OpenSSL and enter the original passphrase.

  • Passphrase works here but not in another tool

    Key derivation differs between tools. Match the PBKDF2 hash, salt, and iteration count — or use a raw hex key so no derivation is involved.

  • Invalid Base64 or Hex ciphertext

    Paste the complete value without extra spaces or line breaks, and select the same output format used when encrypting.

Frequently Asked Questions

What is AES encryption?
AES (Advanced Encryption Standard) is a symmetric encryption algorithm adopted by NIST (FIPS 197) and used worldwide. The same secret key is used for both encryption and decryption. AES operates on 128-bit blocks and supports 128, 192, and 256-bit key sizes.
Which AES mode should I use?
Use AES-GCM for almost everything. It provides both confidentiality and authenticity — it can detect if the ciphertext was tampered with. CBC is older and does not provide authentication. CTR converts AES into a stream cipher. Avoid ECB — it reveals patterns in your data.
What is an IV and why does it matter?
An IV (Initialization Vector) ensures that encrypting the same plaintext twice produces different ciphertext. The IV does not need to be secret — it is sent alongside the ciphertext. Never reuse an IV with the same key, especially in GCM mode, where IV reuse can completely break security.
Can I use a regular password as an AES key?
Yes, but not directly. This tool derives a proper AES key from your passphrase using PBKDF2-HMAC-SHA256 with a random salt and 600,000 iterations by default (the OWASP recommendation). If you prefer a raw key, switch the key format to Hex or Base64.
Why does my decryption fail?
Common causes: wrong key, wrong IV, wrong mode, wrong output format (Base64 vs Hex), or corrupted ciphertext. For GCM, the auth tag must also match. Use the exact same key, IV, mode, key size, and output format as during encryption.
Is it safe to encrypt data in my browser?
Yes. All encryption runs entirely in your browser using the Web Crypto API — a built-in, browser-native cryptographic library. Your plaintext, ciphertext, keys, and IVs are never transmitted to any server.
Is this an online AES tool?
Yes — it is an online tool you can open from any browser, but unlike most online AES encryption sites, all processing runs locally on your device. Your keys, IVs, and text are never sent to a server.
What is the difference between AES-128, AES-192, and AES-256?
The number refers to the key size in bits. AES-128 uses a 16-byte key, AES-192 uses 24 bytes, and AES-256 uses 32 bytes. Larger keys provide a larger key space. AES-128 is already considered secure; AES-256 is recommended for long-term security.
What is PBKDF2 and why does this tool use it?
PBKDF2 (Password-Based Key Derivation Function 2, RFC 8018) derives a cryptographic key from a passphrase by applying HMAC-SHA256 repeatedly. The iteration count makes brute-force attacks expensive. A random salt ensures the same passphrase produces a different key each time.
What is AAD (Additional Authenticated Data)?
AAD is data that is authenticated but not encrypted. In GCM mode, AAD is included in the authentication tag calculation — if the AAD is tampered with, decryption fails. A common use: encrypt a message while authenticating a readable header.
Can I use this tool to encrypt passwords for storage?
No. AES is designed for encryption (reversible), not password hashing (one-way). For storing passwords, use a dedicated hashing algorithm like bcrypt, Argon2, or scrypt.
How do I decrypt a CryptoJS string that starts with U2FsdGVkX1?
U2FsdGVkX1 is the Base64 encoding of "Salted__", the header CryptoJS.AES.encrypt writes when you pass a passphrase. The next 8 bytes are the salt. Switch the preset to CryptoJS, paste the full string, and enter the original passphrase. CryptoJS derives the key with MD5-based EVP_BytesToKey, so the legacy format is weaker than PBKDF2 — use it to read existing data, not for new data.
Can this tool decrypt data from OpenSSL enc?
Yes, for passphrase-based output in the "Salted__" format, for example openssl enc -aes-256-cbc -pbkdf2 -a. Select the OpenSSL preset and match the iteration count and digest used on the command line. Output made with -K and -iv (raw key and IV) can be decrypted with a Hex key and a manual IV instead.
How large a file can I encrypt?
Files are read and encrypted in your browser, so the practical limit is your device memory rather than an upload cap. Very large files can be slow or fail on devices with limited memory, such as phones. The file never leaves your device. Text input is limited to 1 MB.
What is the tm1 bundle format?
A tm1 bundle is one text string, starting with tm1, that packs everything needed to decrypt: the mode, key size, PBKDF2 settings and salt (for passphrases), the IV, the auth tag, and the ciphertext. Paste it back into the tool with the same passphrase to decrypt. The passphrase or key is never stored in the bundle.
How does the tool tell me the key is wrong?
AES-GCM authenticates the data, so a wrong key, IV, AAD, or modified ciphertext makes decryption fail with a clear "wrong key or modified data" message. CBC and CTR have no authentication: a wrong key may return garbage or a padding error instead, so check the key, IV, and format when the result looks unreadable.

Guide

AES-GCM vs CBC: which mode to use, and the mistakes that still break AES

Last updated: