Sometimes a message needs to travel through an untrusted channel, such as email or a shared document, and the only safe way is to encrypt it first. AES-GCM is the modern standard for that job: a symmetric cipher that both scrambles the text and detects tampering, so a modified ciphertext fails to decrypt rather than silently producing wrong plaintext. This tool performs AES-GCM entirely in your browser using WebCrypto, with the key derived from your password via PBKDF2. Nothing is uploaded, nothing is stored, and the ciphertext output contains the salt and initialisation vector needed for decryption.
Quick Answer: Enter a password and plaintext, click Encrypt, then decrypt the ciphertext with the same password to recover it.
Free Online Tool
AES Encrypt / Decrypt Tool
Client-side AES-GCM encryption and decryption via WebCrypto, entirely in the browser.
How to Use the AES Encrypt / Decrypt Tool
- Choose a strong password and type it in the password field.
- Type the plaintext message you want to protect.
- Click Encrypt and copy the ciphertext shown.
- To decrypt, paste the ciphertext into the ciphertext field.
- Enter the same password and click Decrypt.
- Read the recovered plaintext, and keep the password safe: without it, decryption is impossible.
Key Features
- AES-256-GCM encryption with authentication, via WebCrypto.
- PBKDF2 key derivation with a random salt per encryption.
- Random initialisation vector per encryption, so identical plaintexts differ.
- Ciphertext format carries salt and vector, so decryption needs only the password.
- Tampered ciphertext fails decryption instead of producing garbage.
- Fully client-side: password and plaintext never leave your browser.
What the Result Means
The ciphertext is three Base64 parts joined by colons: salt, initialisation vector, and encrypted data. The salt makes the key unique to this encryption even if the password is reused, and the vector makes the encryption unique even for identical plaintexts, so two encryptions of the same message look different. Decryption reverses the process only with the exact password; a wrong password produces a clear failure, not a wrong message, because GCM authentication detects the mismatch. Losing the password means losing the message permanently, which is the price of real encryption.
Worked Example
A freelancer needs to send a server password to a client over email. She types the password as plaintext, chooses a strong passphrase shared with the client by phone, and clicks Encrypt, producing a three-part ciphertext she pastes into the email. The client pastes that ciphertext here, enters the same passphrase, and clicks Decrypt to recover the original password. Anyone intercepting the email sees only the ciphertext, and without the passphrase it is useless to them. The client should also delete the email after decryption, since the ciphertext alone is harmless but keeping it alongside a written-down passphrase in the same mailbox would undo the protection.
Best Practices and Tips
- Use a long, unique password; the cipher is only as strong as the password behind it.
- Share the password through a different channel from the ciphertext.
- Never reuse the same ciphertext for a different message; encrypt fresh each time.
- Store the full three-part ciphertext, since all three parts are needed to decrypt.
- Treat the tool as a scratchpad: do not rely on this page to store secrets.
Common Mistakes to Avoid
- Using a short or guessable password and expecting the cipher to compensate.
- Sending the password alongside the ciphertext in the same message.
- Truncating the ciphertext when copying, which breaks decryption.
- Assuming encryption also proves who sent the message; it proves secrecy, not identity.
Frequently Asked Questions
Is this real AES encryption?
Yes. It uses the browser WebCrypto AES-GCM implementation, the same standard used by secure web applications.
Why does encrypting twice give different output?
Because a fresh random salt and vector are used each time, which is correct and important behaviour.
What if I forget the password?
The message cannot be recovered. There is no back door and no reset, by design.
Does the site see my password or message?
No. All cryptography runs in your browser, and nothing is sent to any server.