AES Encrypt / Decrypt

Encrypt text with a passphrase using AES-256-GCM, or decrypt it.

About AES Encrypt / Decrypt

An AES encryption tool that encrypts text with a passphrase using AES-256-GCM and a PBKDF2-derived key, and decrypts it again, entirely in your browser.

How to use

  1. Choose Encrypt, type a passphrase and the text to protect. The ciphertext appears about 300 ms after you stop typing, as a single line starting with xutil-aes1:.
  2. Copy or download it. Each run uses a fresh salt and IV, so encrypting the same text twice gives two different ciphertexts that both decrypt.
  3. Choose Decrypt, paste the ciphertext and enter the same passphrase. A wrong passphrase or any altered byte is reported as a failed authentication check rather than producing garbage.

What it does

  • Key derivation: PBKDF2 with SHA-256, a random 16-byte salt and 310,000 iterations turns the passphrase into a 256-bit key. The iterations make each guess at the passphrase cost 100 ms or more.
  • Cipher: AES-256-GCM with a random 12-byte IV. GCM is authenticated encryption: a 16-byte tag detects tampering, so decryption either returns the exact original text or fails.
  • Format: xutil-aes1: followed by Base64 of salt(16) || iv(12) || ciphertext || tag(16). The prefix names the scheme so the format can change without breaking old payloads.
  • Portability: any library that offers PBKDF2 and AES-GCM can decrypt this payload once it splits the bytes as above; the scheme is printed under the output. It is not compatible with openssl enc, which uses its own key derivation and a Salted__ header.
  • A passphrase is only as strong as its guessability. PBKDF2 slows an attacker down; it does not make a short passphrase safe.

Example

passphrase  correct horse battery staple
plaintext   meet at noon
→ xutil-aes1:cERqvGsx3cZDqEN1PVwhUcL4JzOZa6JKScQGHtWjVuojj6el2O5Ivmmkw6053dKmKuGFdTW2u1o=
  (your output differs: salt and IV are random each time)

Privacy

Encryption and decryption use the browser's WebCrypto API (crypto.subtle) on this page. The passphrase, plaintext and ciphertext never leave the page, no request is made, and nothing is stored.

Frequently asked questions

Is AES-256 secure?
Yes. AES-256 has no practical attack and is approved for the highest classification levels. In practice the weak point is never the cipher but the passphrase, the key derivation, or a misused IV, which is why this tool uses PBKDF2 with a high iteration count, a random salt and a fresh IV every time.
What is the difference between AES-GCM and AES-CBC?
CBC only encrypts; it does not detect tampering, and padding makes it vulnerable to padding-oracle attacks when used without a separate MAC. GCM encrypts and authenticates in one pass with a 16-byte tag, so a modified ciphertext or wrong key is rejected instead of decrypting to garbage. New designs should use GCM.
Can I decrypt without the passphrase?
No. The key is derived from the passphrase and is never stored, and AES-256 cannot be brute-forced. The only route is to guess the passphrase, and PBKDF2 at 310,000 iterations makes each guess cost around a tenth of a second.
Why can OpenSSL not decrypt this output?
The command openssl enc writes a Salted__ header and derives its key with its own EVP_BytesToKey or PBKDF2 settings, in a layout that differs from this tool. The bytes here are salt, IV, ciphertext and GCM tag in that order after a text prefix; decrypt them with any AES-GCM library following that layout, not with openssl enc.