Is my passphrase or plaintext sent to a server?

No. Encryption and decryption run through the browser's built-in Web Crypto API, so the passphrase, plaintext and ciphertext never leave the tab you're working in.

Why does decryption fail with the right-looking passphrase?

AES-GCM authenticates the ciphertext, so a mistyped passphrase, a truncated Base64 string, or any edit to the blob causes decryption to throw rather than return corrupted output.

How is the encryption key derived from my passphrase?

PBKDF2 with SHA-256 and 100,000 iterations stretches the passphrase using a fresh random 16-byte salt each time you encrypt, producing a 256-bit AES key that is never reused across messages.

Can I use this for encrypting real secrets or backups?

The primitives are standard (AES-256-GCM, PBKDF2), but there's no key management, versioning, or recovery if you forget the passphrase, so treat it as a quick local utility rather than a backup system.

AES Encrypt / Decrypt

Encrypt or decrypt text with AES-256-GCM and a passphrase (PBKDF2), all local.

Local, Runs entirely in your browser, your data never leaves your device.

Loading tool…

Passphrase-based AES-256-GCM in the browser

This tool encrypts or decrypts text with AES-256-GCM, a passphrase-based cipher, using the Web Crypto API. The passphrase is stretched into a key with PBKDF2 (SHA-256, 100,000 iterations) and a random salt, so the same passphrase never produces the same key twice. Both the passphrase and the plaintext stay in the browser tab; nothing is sent anywhere.

How to use the AES Encrypt / Decrypt

Choose Encrypt or Decrypt with the mode toggle at the top.
Enter a passphrase; it never leaves the browser and is not stored.
Paste plaintext to encrypt, or a Base64 ciphertext to decrypt.
Copy the resulting Base64 blob, which packs the salt, IV and ciphertext together.
Keep the passphrase safe separately, decryption fails if it does not match exactly.

The output is a single Base64 string made of a 16-byte salt, a 12-byte IV and the GCM ciphertext concatenated together, so it is self-contained and safe to store or move as one value without tracking those parts separately.

GCM authenticates the ciphertext, so a wrong passphrase or any tampering with the Base64 blob makes decryption fail outright with an error instead of returning garbled text.

Frequently asked questions

Is my passphrase or plaintext sent to a server?: No. Encryption and decryption run through the browser's built-in Web Crypto API, so the passphrase, plaintext and ciphertext never leave the tab you're working in.
Why does decryption fail with the right-looking passphrase?: AES-GCM authenticates the ciphertext, so a mistyped passphrase, a truncated Base64 string, or any edit to the blob causes decryption to throw rather than return corrupted output.
How is the encryption key derived from my passphrase?: PBKDF2 with SHA-256 and 100,000 iterations stretches the passphrase using a fresh random 16-byte salt each time you encrypt, producing a 256-bit AES key that is never reused across messages.
Can I use this for encrypting real secrets or backups?: The primitives are standard (AES-256-GCM, PBKDF2), but there's no key management, versioning, or recovery if you forget the passphrase, so treat it as a quick local utility rather than a backup system.