How to Encrypt and Decrypt Text with the AES Cipher Tool

What the AES Cipher tool does

Use the AES Cipher tool when you need to turn readable text into an encrypted token or recover text from a token you created earlier. It accepts text, a password, and an encryption or decryption choice. For nonempty text, the password is required in either mode; an empty text input is handled as a successful empty result before password validation.

How to encrypt or decrypt text

1. Enter the text you want to process. For encryption, this is the readable text you want to protect. For decryption, enter the complete token previously produced by the tool.

2. Enter the password. When the text field is not empty, use the same password during decryption that you used during encryption. Do not place the password beside the encrypted token when saving or sharing them.

3. Select encryption or decryption, then run the tool.

4. If you selected encryption, keep the resulting URL-safe Base64 text token intact. It contains a version prefix, the salt, the nonce, and the authenticated ciphertext. Each encryption generates a new random 16-byte salt and 12-byte nonce, so repeating encryption with the same text and password can produce a different token.

5. If you selected decryption, provide the complete token and the original password. A valid pair recovers the original UTF-8 text. The encryption process uses AES-256-GCM with a 32-byte key derived from the password by PBKDF2-HMAC-SHA256 with a random 16-byte salt and 600,000 iterations.

How to read the result

An encryption result is one URL-safe Base64 text token rather than readable prose. Because the salt and nonce are random for each encryption, different tokens for the same input and password can be expected. The token must remain complete for decryption.

Successful decryption requires both a complete token produced by the tool and the same password used to encrypt it. If the token is malformed or altered, or if the password is wrong, the tool uses one combined invalid-ciphertext-or-password error and does not identify which condition caused it. Check the token for missing characters and confirm the password without assuming that the error distinguishes between those possibilities.

An empty text input is a special case: the tool returns a successful empty result before checking whether a password was supplied. This exception does not change the password requirement for nonempty text.

Worked example

You want to convert the sentence "Meeting at 3 PM" into a token and later recover the same sentence.

Enter the sentence "Meeting at 3 PM" and a password, choose encryption, and run the tool. Then use the resulting complete token with the same password in decryption mode.

Encryption returns one URL-safe Base64 text token containing a version prefix, salt, nonce, and authenticated ciphertext. Decrypting that complete token with the same password returns the original UTF-8 sentence.

Limitations

• Decryption depends on having the complete, unaltered token and the same password used for encryption. A malformed or altered token and a wrong password share one invalid-result category.

Common errors

• If decryption fails, a missing or altered part of the token and a wrong password produce the same combined error category. Re-enter the complete token and verify the original password, then try again.

FAQ

Is a password required?

For nonempty text, yes: a password is required for both encryption and decryption. Empty text is handled as a successful empty result before password validation.

What do I need to decrypt a token?

Yes. Use the complete token produced by the tool and the same password used during encryption. A valid pair recovers the original UTF-8 text.

Why can the encrypted token change when the input stays the same?

It can. Each encryption creates a new random 16-byte salt and 12-byte nonce, so the same text and password can produce a different token on another run.