AES Encryption and Decryption
Encrypt a message with a password and decrypt it later, or work with raw keys and IVs to test your own code. Encryption happens on your device with the Web Crypto API.
Add this calculator to your website
Copy the code and paste it into your page's HTML. It's free; please keep the credit link.
What the password mode does
Your password is stretched into a 256-bit key with PBKDF2-HMAC-SHA256 and 600,000 iterations (the OWASP recommendation), using a random 16-byte salt. The text is encrypted with AES-256-GCM under a random 12-byte nonce, and the result is salt + nonce + ciphertext + 16-byte tag, written as Base64. Encrypting the same text twice gives different output, which is expected.
Decrypting it elsewhere takes a few lines, for example in Python with the cryptography package:
import base64
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
data = base64.b64decode(ciphertext)
salt, nonce, body = data[:16], data[16:28], data[28:]
key = PBKDF2HMAC(hashes.SHA256(), 32, salt, 600_000).derive(password.encode())
print(AESGCM(key).decrypt(nonce, body, None).decode())AES in short
AES (FIPS 197) is the block cipher standardised by NIST in 2001. It encrypts 16-byte blocks with a 128, 192 or 256-bit key, and the mode decides how blocks are chained: CBC needs padding and a random IV, CTR turns AES into a stream cipher, and GCM adds an authentication tag that detects any change to the ciphertext. Losing the password or key means losing the data: there's no way to recover it.
Frequently asked questions
Which option should I choose?
For your own messages, use the default password mode (AES-256-GCM): it's authenticated, so a wrong password or tampered text is detected. Use the OpenSSL/CryptoJS format to exchange data with code that uses CryptoJS.AES or openssl enc, and raw key mode to match a specific implementation.
Can a ciphertext starting with U2FsdGVkX1 be decrypted here?
Yes, if you know the password. U2FsdGVkX1 is Base64 for “Salted__”, the header written by CryptoJS and OpenSSL. Both the older MD5 and the newer SHA-256 key derivation are tried automatically.
Why is there no ECB mode?
Browsers don't offer it because it's insecure: identical blocks of plain text produce identical blocks of ciphertext, leaking patterns. Use CBC, CTR or, best, GCM.
Is what I paste sent to a server?
No. This tool runs entirely in your browser with JavaScript and the built-in Web Crypto API. Nothing you type, paste or open is uploaded or stored.