Skip to content
Categories
AES Encryption / Decryption
Encrypt and decrypt text with AES-GCM using a passphrase.
Overview
- Derives an encryption key from your passphrase using PBKDF2 (100,000 iterations), and encrypts or decrypts text with AES-256-GCM.
- A random salt and IV (initialization vector) are generated on every encryption, so the same plain text and passphrase produce a different ciphertext each time.
- The ciphertext bundles the salt, IV, and encrypted data together, and is output and input as a single Base64 string.
Usage
- Select "Encrypt" or "Decrypt" as the mode.
- Enter the text (plain text for encryption, or Base64-encoded ciphertext for decryption) and a passphrase.
- Click the "Encrypt" or "Decrypt" button to see the result.
Example
Input
Plain text: Hello, World! / Passphrase: correct horse battery staple
Output
A Base64-encoded ciphertext (different every time)
Use Cases
- Encrypting text lightly before sharing it with someone else
- Checking whether an AES encryption/decryption implementation in your application works correctly with standard parameters
- Learning about and verifying how AES-GCM encryption and decryption work
FAQ
Can I still decrypt if I forget the passphrase?
No. The passphrase is never stored anywhere, so there is no way to decrypt the ciphertext if you forget it.
Does encrypting the same text twice produce the same ciphertext?
No. A random salt and IV are generated on every encryption, so the same plain text and passphrase produce a different ciphertext each time. This is expected behavior.
Is the text or passphrase I enter sent anywhere?
No. Encryption and decryption happen entirely in your browser using the Web Crypto API.
Notes
- We do not recommend using the ciphertext or passphrase generated by this tool for long-term storage of real sensitive information.
- When decrypting, enter the Base64 string exactly as it was output during encryption, without adding line breaks or spaces.
Related Tools
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hash values from text.
Generate an RSA public/private key pair in PEM format.