AES Online Encryption and Decryption Tool

Report a Problem
AES Symmetric Encryption Browser-side Processing
Enter a password and the tool will automatically derive an AES encryption key.
No advanced settings are needed for normal use. Developers can specify the key, IV / Nonce, AAD, and output encoding here for API integration and cross-language verification.
For general use
For API integration and cross-language development
A unique random value used by GCM. Generated automatically during encryption and must remain the same during decryption.
Decryption requires the password, Nonce, ciphertext, and Tag. All four are required.
Recommended: AES-256-GCM provides built-in integrity protection. Save the Nonce and Tag with the ciphertext; all three are required for decryption.
Privacy Notice：Keys, passwords, and plaintext are processed entirely in your browser and are never uploaded to the server.

AES-256-GCM by default; encrypt and decrypt with a password, with advanced options for key, Nonce, AAD, and Tag

AES Online Encryption and Decryption

AES is one of the most widely used symmetric encryption algorithms. The same key is used for encryption and decryption. The tool provides a simple three-step workflow while also allowing advanced parameters to be configured.

Core Features

Separate encryption and decryption tabs are provided. The tool supports 12 combinations of AES-256, AES-192, and AES-128 with GCM, CBC, CTR, and ECB. AES-256-GCM is the default and recommended option, while ECB is not recommended. In password mode, the key is derived automatically, and a random password can be generated.

The result is displayed in separate sections for ciphertext, Nonce or IV, and Tag. Each part can be copied individually, all parameters can be copied as JSON, and the parameters can also be downloaded. The encryption result can be filled into the decryption form with one click.

Advanced Parameters

The key source can be either a password with automatic key derivation or a hexadecimal AES key. AES-128, AES-192, and AES-256 require 32, 48, and 64 hexadecimal characters respectively. Leaving Nonce or IV blank generates it automatically. Decryption must use exactly the same values as encryption.

In GCM mode, AAD participates in integrity authentication but is not encrypted. Output encoding can be Base64 or Hex.

Mode Recommendations

GCM is recommended because it provides integrity authentication; the Nonce and Tag should be stored. CBC requires the IV to be stored. CTR uses a counter that must not be reused with the same key and also requires an IV. ECB can reveal plaintext patterns and should only be used for compatibility purposes.

Errors and Compatibility

The tool validates key, IV, and Nonce lengths. GCM decryption requires a Tag, and the ciphertext encoding must match the selected input encoding. Decryption failures provide troubleshooting guidance. GCM uses WebCrypto and may require a secure context or HTTPS; if unavailable, CBC can be tried instead.

Use Cases

Useful for encrypting configuration values, backups, and temporary strings, testing API JSON interoperability, comparing implementations across PHP, Java, Go, and Python, and learning about encryption modes, padding, IVs, and integrity authentication.

Privacy

Keys, passwords, and plaintext are processed locally and are neither uploaded nor stored. The copy-all-parameters JSON output excludes the password. Use test data rather than production keys for testing and learning.

Perform AES encryption and decryption online

AES is one of the most widely used symmetric encryption algorithms, using the same key for encryption and decryption. The tool defaults to AES-256-GCM with integrity authentication, while advanced users can specify all parameters precisely.
  • 12 encryption combinations: AES-256/192/128 paired with GCM, CBC, CTR, and ECB; GCM is marked recommended and ECB is marked not recommended
  • Simple mode only requires content and a password; the key is derived automatically and a random password can be generated
  • Advanced parameters support hexadecimal AES keys, custom Nonce or IV, additional authenticated data AAD, and output encoding
  • Output encoding supports Base64 and Hex; GCM automatically generates a 16-byte authentication Tag
  • Results are displayed separately as ciphertext, Nonce, and Tag; each can be copied individually, while all parameters can also be copied as JSON or downloaded
  • One-click filling puts the ciphertext, Nonce, Tag, and encryption mode into the decryption form for quick round-trip verification
Suitable for encrypting configuration values, API integration, and comparing implementations across programming languages. The page explains the security characteristics and IV requirements of each mode; keys, passwords, and plaintext are processed entirely in the browser and are never uploaded.
Comments 0
No comments yet. Be the first to comment!
Comment content cannot be empty
0/255