AES Encrypt & Decrypt — AES-256-GCM Password Encryption in Browser

How to use

1. 1 Pick Encrypt or Decrypt.
2. 2 Enter your password — use the strength meter as a rough guide.
3. 3 Paste plaintext (encrypt) or Base64 ciphertext (decrypt), then click the action button.
4. 4 Copy the output. The password never leaves your browser.

Why use this tool

• AES-256-GCM authenticated encryption — tampering is detected, unlike raw AES-CBC.
• PBKDF2-SHA256 with 100,000 iterations slows offline brute-force attacks on weak passwords.
• Random 16-byte salt and 12-byte IV per encryption — same plaintext + password produces different output every time.
• Pure WebCrypto — runs in your browser, no servers see your password or plaintext.

Frequently asked questions

What is AES Encrypt & Decrypt?

An AES Encrypt & Decrypt tool is a tool that encrypts and decrypts text using AES-256-GCM with a user-supplied password. It derives the encryption key from the password using PBKDF2 with SHA-256, providing authenticated encryption that detects tampering. All cryptographic operations run entirely client-side in the browser, so plaintext, passwords, and ciphertext are never sent to a server.

Features

Example

Plaintext "hello" + password "s3cret"

Base64 envelope: salt ‖ IV ‖ ciphertext ‖ GCM tag (differs every run due to a random salt/IV; the same password decrypts it back to "hello").

Common use cases

1. 1

   Share a secret safely

   Encrypt a note or credential and send the ciphertext; the recipient decrypts with the shared password.

2. 2

   Store sensitive text

   Keep an encrypted blob in notes or a repo instead of plaintext.

3. 3

   Learn authenticated encryption

   See how salt, IV, ciphertext, and the GCM tag combine — and why a wrong password fails.

References

• FIPS 197 — Advanced Encryption Standard (AES) — NIST
• NIST SP 800-38D — Galois/Counter Mode (GCM) — NIST
• RFC 8018 — PKCS #5: Password-Based Cryptography (PBKDF2) — IETF

Related tools