AES-256 Encryption & Decryption

AES-256-GCM / CBC with a passphrase-derived or hex key, Base64 / Hex output. Everything runs locally in your browser — plaintext and keys are never sent to the server.

Key source

Your key is saved only in this browser and restored next time. Clear the field to delete the saved key.

Mode

Output

Usage:

Encrypt: type plaintext on the left, pick a key source and enter the key, then click 'Encrypt';
Decrypt: paste the ciphertext on the right. The key source, key and mode must match the ones used for encryption, then click 'Decrypt';
The ciphertext already embeds the random salt (passphrase mode) and IV — no need to store them separately. Different output each time is expected.

What is AES-256

AES (Advanced Encryption Standard) is the most widely used symmetric cipher: a fixed 128-bit block size with 128/192/256-bit keys. AES-256 uses a 256-bit (32-byte) key, and the same key encrypts and decrypts.

Two modes are supported: GCM produces an authentication tag alongside the ciphertext, so tampering is detected — it is the recommended choice; CBC provides confidentiality only and is mainly for compatibility with legacy systems. ECB is not offered because identical plaintext blocks produce identical ciphertext blocks, which is insecure.

Ciphertext Format

So the ciphertext can be decrypted on its own, the encrypted result is concatenated in this order and then encoded as Base64 or Hex:

Passphrase mode: salt (16 bytes) + IV + ciphertext — the salt feeds PBKDF2-SHA256 (100,000 iterations) to derive the 256-bit key;
Hex key mode: IV + ciphertext;
IV length: 12 bytes for GCM, 16 bytes for CBC; GCM ciphertext ends with a 16-byte authentication tag.

To interoperate with other systems, split the decoded bytes in this order. The receiving side must know the key source, mode and encoding.

Go Example (GCM)

key, _ := hex.DecodeString("64-char hex key")
block, _ := aes.NewCipher(key)
gcm, _ := cipher.NewGCM(block)
nonce := make([]byte, gcm.NonceSize()) // 12 bytes
rand.Read(nonce)
// Same layout as this tool: IV + ciphertext
out := gcm.Seal(nonce, nonce, plaintext, nil)

FAQ

Why is every encryption result different?: A random IV (and a random salt in passphrase mode) is generated for each encryption, so the same plaintext and key never produce the same ciphertext. This is a security feature and does not affect decryption.
GCM or CBC?: Choose GCM for anything new: it authenticates the ciphertext, so tampering makes decryption fail. Use CBC only when integrating with legacy systems that require it.
How much longer is the ciphertext?: The ciphertext is always longer than the plaintext. AES processes data in fixed 128-bit (16-byte) blocks: CBC requires PKCS#7 padding of the plaintext to a multiple of 16 bytes (a full block is added even when nothing is missing, so up to 16 extra bytes); GCM is a streaming mode whose ciphertext matches the plaintext length exactly, with no padding. Beyond that, fixed overhead is included: the IV (12 bytes for GCM, 16 for CBC), an extra 16-byte salt in passphrase mode, and a 16-byte authentication tag for GCM. Base64 encoding then expands the result by roughly 4/3 (Hex about 2x). For example, passphrase + GCM + Base64 on 10 Chinese characters (30 bytes in UTF-8): 30 plaintext bytes + 16 salt + 12 IV + 30 ciphertext bytes + 16 tag = 104 bytes total, which encodes to 140 Base64 characters.
Can AES be parallelized across blocks?: It depends on the mode of operation. The AES core encrypts one 16-byte block at a time; whether blocks can be processed in parallel is decided by the outer mode: GCM is built on CTR mode, where each block's counter (IV + block index) is independent of the others and derived from the same key and IV, so every block can be computed independently — encryption and decryption are fully parallelizable (GPU/CUDA AES acceleration exploits exactly this); CBC encryption is inherently serial because each block's input depends on the previous ciphertext block, while CBC decryption is parallelizable since all blocks can first be decrypted independently and then XORed. For very large files distributed across machines, split the data into chunks yourself, give each chunk its own IV, and encrypt them independently before concatenating.
Decryption failed — what should I check?: In order: the key source and key must exactly match encryption, the mode (GCM/CBC) must match, the output format (Base64/Hex) must be selected correctly, and the ciphertext must be complete.
Are my key and plaintext uploaded?: No. This page uses the browser's built-in Web Crypto API for all computation — nothing is ever sent to the server.

Feedback