How strong is this encryption?
AES-256 with GCM is a strong, widely used standard. The strength of your result depends on the passphrase. Use a long random passphrase or a password manager entry, not a short word.
AES Encryption and Decryption
Encrypt a message with AES-256-GCM using a passphrase, or decrypt Base64 ciphertext. The work happens in your browser.
Runs in your browser — nothing is uploaded
About the AES Encryption and Decryption
AES is the standard symmetric cipher used to protect data at rest and in transit. GCM mode adds an authentication tag, so tampering with the ciphertext is detected and decryption fails rather than producing garbage.
This tool derives the key from your passphrase with PBKDF2-SHA256 and 310,000 iterations, which slows down guessing attacks. The output contains a random salt and IV, so the same message encrypts differently each time. Keep the passphrase somewhere safe, because the data cannot be recovered without it.
FAQ
AES Encryption and Decryption — frequently asked
Why does the output look random?
Ciphertext should look random. The Base64 output packs a 16-byte salt, a 12-byte IV and the encrypted data with its authentication tag.
What happens if I lose the passphrase?
Nothing can recover the data. There is no back door, so store the passphrase in a password manager or another secure place before you encrypt anything important.
Why does decryption fail with the right passphrase?
The ciphertext was probably copied incompletely, or extra characters were added. GCM rejects any change, so check that you copied the full Base64 string.
Can I use this to send files?
This tool handles text. For files, use a dedicated encryption tool or your operating system's encrypted archive feature. Share the passphrase through a separate channel.
Is my message or passphrase sent anywhere?
No. The Web Crypto API performs the operations in your browser, and neither the passphrase nor the message is uploaded.
Related tools
Base64 Encoder & DecoderTurn text into Base64 or decode it back, with correct UTF-8 handling for accents and emoji. Everything happens on your device.HMAC GeneratorCompute an HMAC signature for a message and secret key in hex or Base64, the same way most webhook and API providers do.Hash Generator (MD5, SHA-1, SHA-256)Hash a line of text with MD5, SHA-1 and SHA-256 side by side. The digests update as you type, and nothing is sent to a server.