Decryption only works on ciphertext produced by this tool (or anything using the same salt+IV+mode-prefixed layout) with a matching passphrase and output format.
Free Online AES-256 Encrypt & Decrypt Tool
Encrypt text with a passphrase using AES-256, or decrypt ciphertext produced by this tool — key derivation (PBKDF2) and encryption both run locally via your browser's native Web Crypto API, never a server. It helps developers protect a local note or test payload with a passphrase when they need encryption rather than reversible encoding.
How AES-256 encryption works here
AES (Advanced Encryption Standard) is a symmetric cipher — the same passphrase is used to both encrypt and decrypt, unlike RSA's public/private key pair. Since a raw passphrase isn't itself a valid 256-bit AES key, this tool first runs it through PBKDF2 (Password-Based Key Derivation Function 2) with a random salt and 250,000 iterations of SHA-256, which turns a human-memorable passphrase into a proper cryptographic key while making brute-force guessing meaningfully slower for an attacker. The derived key is then used with AES in either GCM or CBC mode to actually encrypt your text.
GCM vs. CBC — which mode to pick
AES-GCM is an authenticated encryption mode: it produces a built-in authentication tag, so tampering or corruption of the ciphertext is detected and decryption fails outright rather than returning silently-wrong plaintext. It's the recommended default and what most modern systems (TLS 1.3 included) use. AES-CBC encrypts but doesn't authenticate on its own — it's included for compatibility with systems that specifically expect CBC, not because it's a safer choice.
Why Base64 encoding is not encryption
It's worth being explicit about this since the two are easy to conflate: Base64 (see the Encode / Decode tool) is a reversible text encoding with no key or secret involved — anyone can decode it instantly, and it provides precisely zero confidentiality. AES encryption, in contrast, transforms data using a secret key such that recovering the original text without that key is computationally infeasible. This tool's ciphertext output happens to be displayed as Base64 or Hex text purely so it's easy to copy and paste — the actual security comes entirely from the AES encryption performed before that encoding, not from the encoding itself.
How to use this tool
Choose Encrypt or Decrypt, pick an AES mode (for encrypting) and an output format, enter your text and passphrase, then run it. Save or share the resulting ciphertext along with the passphrase (through a separate, secure channel) — decryption needs both the exact passphrase and the unmodified ciphertext to succeed.
How to use AES-256 Encrypt & Decrypt for related tasks
Enter plaintext and a passphrase, encrypt or decrypt locally, and keep the passphrase separate because it cannot be recovered from the ciphertext.
Related tools: Encode / Decode, RSA Key Pair Generator.
Frequently asked questions
Is my passphrase or plaintext sent anywhere?
No. Every step — key derivation, encryption, and decryption — runs locally using your browser's built-in window.crypto.subtle (Web Crypto API). Nothing you type here is ever transmitted to a server, including the passphrase.
Should I use GCM or CBC mode?
Use GCM unless you have a specific reason not to. GCM is an authenticated mode — it detects if the ciphertext was tampered with or corrupted, and decryption fails cleanly instead of silently returning garbage. CBC provides no authentication on its own, which makes it vulnerable to bit-flipping and padding-oracle style attacks in some contexts. CBC is offered here for compatibility with systems that expect it, not because it's the better default.
What's actually stored in the ciphertext output?
A random 16-byte salt and a random IV are generated for every encryption and bundled directly into the output ahead of the actual ciphertext, along with a marker for which mode was used. That means you only need to keep the passphrase to decrypt later — there's nothing else to separately track or lose.
Why did decryption fail even though I used the right passphrase?
Decryption also fails if even one character of the copied ciphertext was altered, truncated, or if it was encoded as Base64 but pasted back as Hex (or vice versa) — the output format has to match on both ends.
Is browser AES encryption suitable for production secrets?
It can demonstrate the algorithm locally, but production key management, authenticated encryption, transport security, and recovery policy still require careful engineering.