AES Encrypt/Decrypt
EncryptionProcessed locally in your browser using the Web Crypto API. Nothing is sent to any server.
How It Works
This tool provides AES-256 encryption and decryption using your browser's built-in
Web Crypto API. Your passphrase and data never leave your device — all cryptographic operations
happen locally, ensuring complete privacy.
How It Works
- Encryption modes: Choose Standard (AES-256-GCM with PBKDF2) for maximum security, or OpenSSL Compatible (AES-256-CBC with MD5) for interoperability with other tools
- Key derivation: Standard mode uses PBKDF2 with 100,000 iterations; OpenSSL mode uses MD5-based key derivation for compatibility
- Salt & IV: Random values are generated for each encryption, ensuring the same passphrase produces different ciphertext every time
- Authentication: GCM mode (Standard) automatically detects any tampering with the encrypted data
- Output formats: Choose Base64 (compact, for emails/web) or Hex (for code/config files)
How to Choose a Strong Passphrase
- Length matters: Use at least 12-16 characters — longer is exponentially stronger
- Mix character types: Combine uppercase, lowercase, numbers, and symbols
- Avoid patterns: Don't use common words, birthdays, or predictable sequences like "123456"
- Use passphrases: Combine 4-5 random words with numbers and symbols (e.g., "Coffee#Mountain7!Jump")
- Never reuse: Use a unique passphrase for each encryption task
Frequently Asked Questions
How secure is AES-256 encryption?
AES-256 is the gold standard for encryption, used by governments and militaries worldwide. With a 256-bit key, there are 2^256 possible combinations — more than the number of atoms in the observable universe. Even with the most powerful supercomputers, brute-forcing AES-256 would take billions of years.
How do I choose a strong passphrase?
Use a passphrase of at least 12-16 characters with a mix of uppercase, lowercase, numbers, and symbols. Avoid common words, personal information, or predictable patterns. A good method is to combine 4-5 random words with numbers and symbols (e.g., "Coffee#Mountain7!Jump"). Never reuse passphrases across different services.
What is the difference between Base64 and Hex output?
Both are text encodings of the same encrypted data. Base64 is more compact (about 33% smaller) and commonly used in emails and web applications. Hex uses only 0-9 and A-F characters, making it easier to copy-paste into code or configuration files. Choose based on where you need to use the encrypted data.
Is my data sent anywhere?
No. All encryption and decryption happens locally in your browser using the Web Crypto API. Your passphrase and data never leave your device. This tool has no backend server — it is a pure client-side application.
What is the swap button for?
The swap button (↔) quickly switches between encrypt and decrypt modes while swapping the input and output. This is useful when you want to verify your encryption by immediately decrypting it, or when you paste ciphertext and want to switch to decrypt mode.
Can I decrypt ciphertext from other tools?
Yes! This tool automatically detects and decrypts OpenSSL-format ciphertext (starting with "Salted__" prefix, commonly used by other online tools). For Standard format, use this tool for both encryption and decryption. If you need to share encrypted data with other tools, select "OpenSSL Compatible" format when encrypting.
Privacy Note
This tool runs entirely in your browser. Your input is never uploaded, stored, or sent to any server.
Disclaimer: This tool is provided for educational and informational purposes only. The results do not constitute professional security advice. Use at your own discretion.