AES Encryption Tool — GCM, CBC & CTR

What Is AES Encryption?

// AES-256-GCM with a passphrase (PBKDF2-HMAC-SHA256, 600,000 iterations).
// Identical code runs in the browser and in Node.js 20+ via Web Crypto.
async function aesGcmEncrypt(plaintext, passphrase) {
  const enc = new TextEncoder();
  const salt = crypto.getRandomValues(new Uint8Array(16));
  const iv = crypto.getRandomValues(new Uint8Array(12));
  const baseKey = await crypto.subtle.importKey(
    'raw', enc.encode(passphrase), 'PBKDF2', false, ['deriveKey']);
  const key = await crypto.subtle.deriveKey(
    { name: 'PBKDF2', salt, iterations: 600000, hash: 'SHA-256' },
    baseKey, { name: 'AES-GCM', length: 256 }, false, ['encrypt']);
  const ct = new Uint8Array(await crypto.subtle.encrypt(
    { name: 'AES-GCM', iv }, key, enc.encode(plaintext)));
  const packed = new Uint8Array([...salt, ...iv, ...ct]); // salt(16) | iv(12) | ct+tag
  return btoa(String.fromCharCode(...packed));            // self-contained Base64
}

Key Features

AES Encryption Examples

The quick brown fox jumps over the lazy dog.

salt (16 B) + IV (12 B) + ciphertext + tag (16 B), Base64-encoded — a new value on every run

Attack at dawn!

U2FsdGVkX18AESIzRFVmd1PBwxIFQpF+VgIhTK0aDHQ=

How to Encrypt Text with AES

1. 1

   Pick a mode and key size

   Leave Mode on GCM (recommended) and Key size on 256 for the strongest sensible default. Switch to CBC or CTR only if a system you are targeting requires it.

2. 2

   Choose passphrase or raw key

   Keep Key type on Passphrase and enter a strong passphrase, or switch to Raw key and paste an exact 128/192/256-bit key as hex or Base64. The byte-count badge confirms whether your raw key is a valid length.

3. 3

   Enter the text to encrypt

   Type or paste your plaintext. Encryption runs automatically as you type, entirely in your browser — no button round-trip and no upload.

4. 4

   Copy the self-contained ciphertext

   The Base64 result on the right already contains the salt, IV, and authentication tag. Use the segment strip to see the byte layout, then click Copy. Switch the output encoding to Hex if your target system expects it.

5. 5

   Decrypt it back when you need to

   Give the ciphertext, the passphrase, and the same mode and key size to the recipient, or open the AES decrypt page to reverse it yourself.

Common AES Encryption Mistakes

Key type: Raw key
Key (hex): correct horse battery staple   (not hex, not 32 bytes)

Key type: Passphrase
Passphrase: correct horse battery staple   (stretched with PBKDF2)

// same key, same IV for two messages
encrypt(key, iv, a); encrypt(key, iv, b);

// fresh random IV each time (the default)
encrypt(key, randomIV(), a);

stored = ciphertext              // salt + IV + tag thrown away

stored = salt + iv + ciphertext + tag   // the full Base64 string

assert(encrypt(msg) === encrypt(msg))   // fails — and should

assert(decrypt(encrypt(msg)) === msg)   // this is what must hold

What You Can Do with AES Encryption

Learn how AES modes behave

Flip between GCM, CBC, and CTR with the same input to see how authentication, IV length, and ciphertext size change. A hands-on way to understand what NIST SP 800-38D actually specifies.

Produce ciphertext another system can read

Generate output in the OpenSSL Salted__ format (or as a raw key plus IV) so a backend, script, or teammate using openssl or a crypto library can decrypt it without friction.

Encrypt a short note or snippet

Protect a one-off piece of personal text — a recovery phrase you are moving between devices, a snippet in a support ticket — with a passphrase only you know. Not for regulated or production secrets.

Prototype an encryption format

Nail down your salt/IV/tag layout and KDF settings here before writing the code, using the segment breakdown to confirm the byte order and lengths.

Generate test vectors

Create known ciphertext with a fixed passphrase and mode to feed your own decryption tests, then verify the round-trip on the AES decrypt page.

AES Modes & Key Derivation

GCM (Galois/Counter Mode) — authenticated, recommended

Confidentiality plus a 128-bit authentication tag (NIST SP 800-38D). It uses a 96-bit (12-byte) IV, generated randomly per encryption, and both encryption and decryption parallelize well. The one rule you must never break: never reuse an IV with the same key. SP 800-38D limits a single key to about 2^32 randomly generated IVs, and a repeat leaks the XOR of two plaintexts and can even expose the authentication key that protects the tag. Best for almost everything.

CBC (Cipher Block Chaining) — confidentiality only

Each block is XORed with the previous ciphertext block, using a random 16-byte IV. It has no built-in authentication, so it must be paired with a separate MAC — encrypt-then-MAC, for example with our HMAC generator — and it is historically prone to padding-oracle attacks (Vaudenay, EUROCRYPT 2002). Offered here for interoperability with OpenSSL and older systems.

CTR (Counter) — confidentiality only, stream-like

Turns AES into a stream cipher by encrypting a counter, so any byte length works without padding and blocks parallelize freely. Like CBC it provides no integrity on its own, and reusing the counter/IV under one key is catastrophic. Useful when you need random access or streaming semantics.

ECB — not offered (by design)

Electronic Codebook encrypts each block independently, so identical plaintext blocks produce identical ciphertext and patterns leak — the notorious 'ECB penguin'. The Web Crypto API deliberately does not implement it, and neither do we. If a legacy peer requires ECB, treat that as a bug to fix rather than a format to reproduce.

Key derivation: 600,000 vs 10,000 vs 1 iteration

In the default passphrase mode this tool uses PBKDF2-HMAC-SHA256 at 600,000 iterations (the same SHA-256 hash applied hundreds of thousands of times) with a 16-byte salt, per OWASP. In OpenSSL-compatible mode, PBKDF2 defaults to just 10,000 iterations (the openssl enc default), and the legacy EVP_BytesToKey KDF used by CryptoJS and old OpenSSL runs a single MD5 pass — orders of magnitude weaker. More iterations mean a slower brute-force per guess, which is why the modern default is so much higher. Argon2 and scrypt are stronger still but are not part of Web Crypto, so they are out of scope here; for password storage, follow OWASP and prefer Argon2id.

AES Encryption Best Practices

Prefer GCM unless a peer requires otherwise

Authenticated encryption catches tampering that CBC and CTR silently pass through. Only drop to CBC or CTR for interoperability, and add a MAC if you do.

Use a fresh random IV for every message

The tool does this automatically. If you override the IV manually, never reuse one with the same key — for GCM a repeat is catastrophic, and for CBC it breaks semantic security.

Choose strong passphrases and real random keys

PBKDF2 slows brute force but cannot rescue a weak passphrase. Generate a long passphrase with the password generator, or a true random key with the secret key generator.

Keep the salt, IV, and tag with the ciphertext

They are not secret, but decryption fails without them. This tool's self-contained format bundles all three; if you use raw-key bare-ciphertext mode, copy the IV separately and store it alongside the ciphertext.

Do not encrypt production or regulated secrets in any online tool

Even fully client-side, a browser tool is for learning, debugging, and personal one-offs. Real secrets belong in a vetted key-management system with audited key handling and rotation. AES-256 itself is strong — approved under the NSA CNSA 2.0 suite for information up to TOP SECRET — and real-world breaks come from implementation mistakes, not the cipher.

AES Encryption FAQ