AES Encrypt & Decrypt
Encrypt and decrypt text with AES-256-GCM and a key derived from your passphrase with PBKDF2-SHA256, entirely in your browser.
Local workspace
Named projects in IndexedDB · Local only — never synced to our servers. Worksp…
Options
| Option | Description |
|---|---|
| Mode | Encrypt turns text into a self-describing string; decrypt turns it back. |
| Passphrase | The key is derived from this. It is never saved, put in a URL, or sent anywhere. |
| PBKDF2 iterations | How much work it takes to turn the passphrase into a key. Higher is slower to attack and slower for you. Decryption reads this number from the message. |
FAQ
What's inside the encrypted output?
Five dot-separated parts after the version: the key derivation name, the iteration count, the random salt, the random nonce, and the ciphertext with its authentication tag, all Base64URL. Everything needed to decrypt travels with the message except the passphrase, which is never included.
Is this safe for real secrets?
AES-256-GCM with a PBKDF2-SHA256 key is a sound recipe, and its strength then depends on your passphrase: a short one can be guessed no matter the cipher. For long-lived secrets prefer a password manager, age, or GPG, and send the passphrase through a different channel than the ciphertext.
Why does decryption fail without saying what went wrong?
GCM verifies an authentication tag before it returns anything, and a wrong passphrase and modified data both fail that check. Distinguishing them would leak information to an attacker, so both report the same error.
What do the iterations change?
They set how long deriving the key takes. More iterations slow down someone guessing passphrases, at the cost of a slower encrypt and decrypt for you. The default of 600,000 follows the current OWASP guidance for PBKDF2-SHA256.
Can I decrypt text that another tool encrypted?
Only if it's in this exact format. Other tools pick different key derivations, modes, and layouts, and there's no universal AES text format to fall back on.