AES Cipher
Encrypt and decrypt text with AES-256-GCM using a key derived from your password.
Run tool
This online cipher utility encrypts plain text into an authenticated token or decrypts an existing token back into readable UTF-8 text. During encryption, the tool derives a 32-byte key from your chosen password using PBKDF2-HMAC-SHA256 with 600,000 iterations and a fresh 16-byte salt. It then applies AES-256-GCM encryption with a unique 12-byte nonce. Because every encryption generates a new random salt and nonce, running the process multiple times on the same input produces distinct tokens. The resulting output is a compact, URL-safe Base64 token containing the version prefix, salt, nonce, and authenticated ciphertext. To restore your original content, paste the complete token into the text area, select the decryption option, and provide the exact password used during creation. If the token is altered, truncated, or paired with an incorrect password, the tool issues an authentication error without revealing which element failed. Submitting an empty text field immediately returns an empty output.
Instructions
- Enter or paste the text you want to process into the Text field.
- Type your secret passphrase into the Password field.
- Select Encrypt to generate an encrypted token, or Decrypt to restore plain text.
- Click the run button to perform the operation.
- Copy the resulting string or token from the output area.
Examples
- Encrypting the phrase "Project Launch Date: October 15" with password "K9#mQ2$vL" produces a Base64 token containing the random salt, nonce, and ciphertext.
- Decrypting a previously generated Base64 token with the matching password "K9#mQ2$vL" restores the exact original text "Project Launch Date: October 15".
FAQ
Why does encrypting the same text twice produce different tokens?
Each encryption run generates a fresh 16-byte random salt for key derivation and a unique 12-byte nonce for AES-GCM, ensuring identical plaintexts yield distinct ciphertexts.
What encryption standard is used?
The tool uses AES-256 in Galois/Counter Mode (GCM) with a 32-byte key derived via PBKDF2-HMAC-SHA256 using 600,000 iterations.
What happens if I enter the wrong password during decryption?
The tool returns an invalid token or password error without revealing whether the issue was an incorrect password or damaged token data.
Is a password required when the text field is empty?
No. When the text field is empty, the tool returns an empty result directly without checking for a password.