AES Encrypt & Decrypt

about this tool

GCM, not CBC

This uses AES-GCM, which authenticates as well as encrypts. Change one bit of an encrypted message and decryption fails outright.

That is not true of AES-CBC, which many online AES tools still use. With CBC and no separate authentication step, altered ciphertext decrypts to different plain text and nothing tells you it happened. An attacker who cannot read your message may still be able to change it in predictable ways. If a tool offers you a choice of mode with no mention of authentication, that is worth noticing.

What travels with the message

Everything needed to decrypt except the passphrase is packed into the output: a version marker, a random salt, and a random initialisation vector, all in front of the ciphertext. One Base64 string is all the recipient needs.

Both random values are new for every message. Reusing an initialisation vector with the same key is the single mistake that breaks GCM completely, which is why they are generated here rather than derived from anything.

Why it pauses

The passphrase is not used as a key directly. It goes through 600,000 rounds of PBKDF2 first, which is the current recommended floor. That pause of a fraction of a second is the point: it costs you almost nothing once and costs an attacker the same amount for every guess.

When decryption fails

The tool says the passphrase may be wrong, the key size may not match, or the message may have been altered, without choosing between them. That is not vagueness. GCM verifies the whole message as one unit, so a failure genuinely cannot be attributed to a particular cause, and guessing would be misleading.

What this is not

This is a good way to put a note somewhere untrusted, or to hand something to a colleague over a channel you would rather not trust, provided you share the passphrase another way. It is not a replacement for a password manager, for encrypted messaging, or for anything where the consequence of being wrong is serious. There is also no recovery: lose the passphrase and the message is gone for good.

For a passphrase strong enough to be the weak point of nothing, use the password generator. To prove a message came from you rather than hide it, use HMAC.

A passphrase is the right shape when one person holds the secret. When two parties need to exchange something without sharing a password, that is asymmetric work — the SSH & RSA key pair generator makes the keys.

questions

Is this safe to use for something that matters?

The construction is the current standard practice: AES-GCM for authenticated encryption, with the key derived from your passphrase by PBKDF2-SHA256 at 600,000 iterations, a fresh random salt every time and a 96-bit nonce. Its weakest point is your passphrase, so use a long one.

Why AES-GCM rather than AES-CBC?

Because GCM authenticates as well as encrypts: altered ciphertext fails to decrypt instead of quietly producing wrong plaintext. Many online AES tools use CBC with no authentication, which cannot tell you that a payload was tampered with.

What is the salt and nonce for, and why is the output different each time?

Encrypting the same text twice with the same passphrase gives different output because a new random salt and nonce are used each time. That is required — reusing a nonce with GCM breaks the encryption badly.

Can I decrypt this somewhere else?

Only with something that reads the same envelope. The output packs a version marker, the salt, the nonce and the ciphertext into one Base64 string; anything decrypting it needs to unpack the same layout and use the same derivation settings.

What happens if I lose the passphrase?

The data is gone. There is no recovery, no reset and no copy of your key anywhere, because encryption and decryption both happen in your browser and nothing is transmitted.