Skip to content
en
All tools

Categories

Developer ToolsEncoding & DecodingJSON & DataHash & ChecksumText ToolsDate & TimeNetwork ToolsFile ToolsMarkdown & Diagrams

AES Encrypt (AES-256-GCM)

Turn text into an authenticated AES-256-GCM ciphertext protected by your passphrase, entirely on your device.

Processed locally in your browser

Options

Choose a long, unique passphrase and keep it safe: it cannot be recovered.

More iterations slow down guessing attacks (and this tool).

0 chars · 0 lines
The result will appear here.

What is AES Encrypt (AES-256-GCM)?

AES-GCM is an authenticated encryption mode: it keeps the text confidential and also detects any modification. Because people remember passphrases rather than 256-bit keys, the tool derives the key with PBKDF2-HMAC-SHA-256, using a random 16-byte salt and a configurable number of iterations (default 600,000). A random 12-byte IV is generated for every message.

The output is Base64 (or hex) of this container: "DTAE" magic (4 bytes) | version 1 (1 byte) | iterations (uint32) | salt (16 bytes) | IV (12 bytes) | ciphertext followed by the 16-byte GCM tag. The header is authenticated too. Paste the result into AES Decrypt with the same passphrase to recover the text. All work uses the browser’s Web Crypto API.

How does it work?

  1. Type or paste the text to encrypt.
  2. Enter a long, unique passphrase and, if you wish, change the PBKDF2 iterations and output encoding.
  3. Click Encrypt and copy the result. Keep the passphrase safe: without it the data cannot be recovered.

Common use cases

  • Protecting a short note or config value before pasting it into a chat or ticket.
  • Learning how authenticated encryption with a passphrase-derived key works.
  • Producing test ciphertexts for a decryption routine.
  • Sharing a secret with someone to whom you give the passphrase through another channel.

Examples

Try this input in the tool above:

Meet me at the usual place at 9pm.

Privacy

AES Encrypt (AES-256-GCM) runs entirely in your browser. The text or files you provide are processed on your device and are not uploaded, logged or stored on our servers.

Limitations

Use a strong passphrase and keep it safe: there is no recovery. Anyone with the ciphertext can guess passphrases offline, so weak ones are cracked easily. This tool is for convenience and learning, not a substitute for audited software (such as age, GPG or a password manager) for high-stakes data.

Frequently asked questions

Why is the output different every time?

A fresh random salt and IV are generated on each run, so the same text and passphrase never produce the same ciphertext. Decryption still works because both are stored in the output.

What happens if I forget the passphrase?

The data is unrecoverable. AES-256 cannot be broken by brute force and no backdoor exists; there is no reset.

Why do more PBKDF2 iterations matter?

They make each passphrase guess slower for an attacker. Each extra iteration costs you a few milliseconds once, but costs an attacker on every guess.

Related tools

More tools in Developer Tools →