AES Encrypt & Decrypt
Encrypt text with a password using AES-256-GCM, or paste ciphertext back in to decrypt it. Everything happens in your browser.
Your password is never stored, never sent anywhere, and never included in the output. It only exists in this browser tab. If you lose it, the encrypted text cannot be recovered — not by you, and not by ToolGenie.
How to Use the AES Encrypt & Decrypt Tool
- Type or paste the message you want to protect into the text box.
- Enter a strong password. Use the "Show" toggle to check for typos before you encrypt.
- Click "Encrypt". The tool returns a single Base64 string containing the salt, the IV and the ciphertext.
- To read it again, paste that Base64 string back in, type the same password, and click "Decrypt".
- Use "Copy result" to move the output somewhere safe, and "Clear" to wipe both fields when you are done.
What Is AES Encrypt and Decrypt?
This tool performs real symmetric encryption with AES-256-GCM, the authenticated cipher built into every modern browser through the Web Crypto API. GCM mode adds an authentication tag, so a ciphertext that has been altered fails to decrypt instead of quietly returning wrong data.
Your password is not used as a key directly. It is stretched with PBKDF2-SHA256 over 250,000 iterations against a fresh 16-byte random salt, which slows down brute-force guessing considerably. Each encryption also uses a fresh 12-byte IV, and the salt, IV and ciphertext are concatenated and Base64-encoded into one string. All of that runs locally: the text, the password and the derived key never leave your browser. The honest caveat is that a short or reused password remains the weak link — no amount of key stretching rescues a password someone can guess.
If you only need transport-safe text rather than secrecy, use the Base64 encoder and decoder instead. For one-way fingerprints reach for the hash generator, and when you need to read an opaque token rather than protect one, the JWT decoder is the right neighbour.
Frequently Asked Questions (FAQ)
Is it safe to send this encrypted text over email?
The ciphertext itself is safe to email — without the password it is unreadable, and GCM authentication means tampering is detected. The real risk is the password: send it through a different channel, such as a phone call or a separate messaging app, never in the same email.
What happens if I forget the password?
The text is gone. There is no recovery, no reset and no backdoor, because the key only ever existed in your browser and was derived from the password you typed. Store the password in a password manager before you rely on the ciphertext.
Is Base64 encryption?
No. Base64 is reversible encoding that anyone can undo in one click — it provides zero secrecy. This tool outputs Base64 only as a safe wrapper around the real AES-256-GCM ciphertext; the encryption is what protects the data, not the Base64.
Does this tool work offline?
Yes. Once the page has loaded, encryption and decryption use only the Web Crypto API in your browser, so you can disconnect and keep working. Nothing is uploaded either way.
What encryption does this use exactly?
AES-256 in GCM mode, with the key derived from your password by PBKDF2-SHA256 using 250,000 iterations and a random 16-byte salt. Every encryption generates a new salt and a new 12-byte IV.
Why does decryption fail even though I typed the right password?
Most often the ciphertext was truncated when it was copied, or an email client wrapped or altered the string. Copy the whole Base64 value, with no missing characters, and check that no autocorrect changed the password.
Can I encrypt a file with this tool?
Not directly — this page handles text. You can encrypt small text-based content such as notes, keys or configuration snippets. For binary files, use a desktop tool that encrypts the file itself.
Tips for Encrypting Text with a Password
- Tip 1: Use a long passphrase rather than a short complex password. Length is what defeats brute force; PBKDF2 only buys time.
- Tip 2: Always send the ciphertext and the password through different channels. Together in one message, they are no better than plain text.
- Tip 3: Test a decrypt round-trip before you delete the original. It takes ten seconds and catches a mistyped password while you can still fix it.
- Tip 4: Let the password generator create the passphrase, then score it with the password strength checker before you trust it with anything that matters.