AES Encrypt / Decrypt

AES encrypt decrypt refers to the process of encrypting plaintext into unreadable ciphertext using the AES algorithm, and reversing that process to recover the original text. Our AES encrypt decrypt tool uses AES-256-GCM- the most widely deployed symmetric encryption algorithm, used by governments, financial institutions, and security professionals worldwide. The "256" refers to the key length in bits, and "GCM" (Galois/Counter Mode) adds authentication to detect tampering. All operations run entirely in your browser using the native Web Crypto API - your text and passphrase never leave your device.

1. 1. Enter Your Text and Passphrase: Select Encrypt or Decrypt mode, paste your text into the input panel, and enter a strong passphrase. The passphrase is never stored or transmitted - it exists only in your browser's memory during the operation.
2. 2. Instant Browser-Based Processing: Click Encrypt Text or Decrypt Text. The tool derives an AES-256 key from your passphrase using PBKDF2-SHA256 and processes the text entirely in your browser via the Web Crypto API. No data leaves your device.
3. 3. Copy or Use the Output: The encrypted Base64 output or decrypted plaintext appears in the right panel. Copy it with one click, or use the "Use Output to Decrypt/Encrypt" button to chain operations without re-pasting.

• AES-256-GCM: AES (Advanced Encryption Standard) in GCM (Galois/Counter Mode) is an authenticated encryption algorithm. It provides both confidentiality (the ciphertext is unreadable without the key) and integrity (the GCM authentication tag detects any tampering). AES-256 uses a 256-bit key, making it resistant to brute-force attacks even with quantum computers using Grover's algorithm.
• PBKDF2-SHA256 Key Derivation: Your passphrase is converted into a 256-bit AES key using PBKDF2 (Password-Based Key Derivation Function 2) with SHA-256 as the hash function and 250,000 iterations. The high iteration count makes brute-force passphrase attacks computationally expensive. A unique random 128-bit salt is generated for each encryption, preventing rainbow table attacks.
• Random Salt and IV: Each encryption generates a fresh 128-bit random salt (for PBKDF2) and a 96-bit random IV (Initialization Vector for AES-GCM). This means encrypting the same plaintext with the same passphrase twice produces completely different ciphertext each time, preventing pattern analysis.
• Base64 Output Format: The encrypted output is Base64-encoded for easy copy-paste and transmission. The format packs: [16-byte salt] + [12-byte IV] + [ciphertext + 16-byte GCM tag]. The decryptor extracts these components automatically - you only need the Base64 string and the passphrase to decrypt.

AES-256-GCM is symmetric encryption - the same passphrase is used to both encrypt and decrypt. This means you must securely share the passphrase with anyone who needs to decrypt the message. If you lose the passphrase, the encrypted text cannot be recovered - there is no backdoor or recovery mechanism. For asymmetric encryption (where the recipient has a public key), use our RSA Key Pair Generator instead. Also note that the security of the encryption depends entirely on the strength of your passphrase - use a long, random passphrase or a password manager to generate one.