Should I use AES-GCM or AES-CBC?

AES-GCM by default — it's authenticated, meaning tampered ciphertext fails decryption instead of silently corrupting plaintext. Use CBC only for compatibility with legacy systems, and always pair it with a separate HMAC.

Why is the IV required and must it be unique?

An IV (initialisation vector) randomises the ciphertext so identical plaintexts encrypt differently. With GCM, reusing an IV under the same key catastrophically breaks confidentiality and authenticity — always use a fresh random IV per message.

Does my key or plaintext leave the browser?

No. Encryption uses the Web Crypto API natively in your browser. The key, plaintext, and ciphertext stay on your device.

aes · gcm/cbc · pbkdf2 · local

Encrypt with AES in the browser

AES-128/192/256 in GCM or CBC. Password derives a key via PBKDF2 (100k iterations, SHA-256). Uses Web Crypto. Runs entirely in your browser.

AES Encrypt

Mode

AES-GCM

AEAD

Key

256

bits

KDF

PBKDF2

100k iters

Status

—

web crypto

input · password + plaintext

Password

Plaintext

output · ciphertext + iv + key

Encrypt to see output

Quick Start

How AES encryption works here

Your password is stretched via PBKDF2 (100k SHA-256 iterations) with a random salt into an AES key. A random IV is generated, then the plaintext is encrypted with the chosen AES mode.

01
Pick mode & size
GCM gives authenticated encryption (recommended). CBC is unauthenticated — only for compatibility.
Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.
modeUTF-8TextEncoderlosslesslive
mode · raw bytesGCM-256 · UTF-8
```
AES-GCM 256
```
loaded · UTF-8MIME · ready
02
Enter password & plaintext
Password is stretched to an AES key — never used directly.
Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.
inputWeb Cryptosubtledeterministiclive
pwd · options••••• · live
```
PBKDF2 → key
```
options applied · livelive
03
Encrypt
Outputs ciphertext, IV, and the derived raw key — all base64.
Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.
encryptmemoisedoptionsinstantreactive
out · encodedb64 · ready
```
ct · iv · key
```
encoded · livelossless
04
Decrypt elsewhere
Pair with the AES Decrypt tool and feed it the same key + IV + mode.
Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.
roundtripclipboardblobMIME-correctclient-side
ok · copiedready · done
```
Copied ciphertext
```
shipped · ready to shipsuccess

Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Use Cases

When to encrypt with AES

Local secrets, encrypted backups, prototype encryption.

Backup files

Encrypt sensitive backups before uploading to cloud storage. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

Prototype crypto

Quick sanity checks while building real systems. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Cross-tool ciphertext

Verify output matches openssl, libsodium, or PyCryptodome. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

Encrypted notes

Self-encrypted journal / note files. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Time-limited shares

Encrypt before paste; share key out-of-band. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Teaching tool

Demonstrate the role of IV, salt, and KDF. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready

FAQ

Frequently asked questions

GCM vs CBC?

GCM is authenticated — it detects tampering. CBC is plain block-mode and needs a separate MAC. Always prefer GCM for new code.

Why PBKDF2 with 100k iterations?

OWASP recommendation as of 2023 (for PBKDF2-SHA256). It slows down brute-force on weak passwords.

Is the salt stored?

This tool currently regenerates a salt on each encrypt and doesn't surface it — it's mainly a demo. Production code should persist it.

Can I decrypt back?

Yes — copy the ciphertext, IV, and key into the AES Decrypt tool.

Is anything sent to a server?

No. AES + PBKDF2 run via Web Crypto — entirely locally in your browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!