Free AES Text Encrypt / Decrypt Tool
Encrypt and decrypt text using AES-256-GCM with a password you choose. The key is derived from your password with PBKDF2, and all cryptography runs locally in your browser using the Web Crypto API — your data and password never leave your device.
AES is symmetric, so both sides share one key — for an asymmetric pair use the RSA Key Generator. To authenticate a message rather than hide it, the HMAC Generator is the right tool.
How to use the AES Encrypt
- 1 Enter the text you want to protect.
- 2 Enter a strong passphrase — it is stretched into an encryption key, so length matters.
- 3 Encrypt to get a Base64 payload containing the salt, initialisation vector and ciphertext.
- 4 To decrypt, paste that payload and the same passphrase.
How to Use
Type your text and a password, then press Encrypt to get a Base64 ciphertext you can share. To reverse it, paste the ciphertext, enter the same password and press Decrypt.
- AES-256-GCM authenticated encryption
- PBKDF2 key derivation (150,000 iterations, SHA-256)
- Random salt and IV generated for every message
- Output is Base64 for easy copy/paste
- 100% client-side — nothing is transmitted
Security notes
Because encryption happens offline, only someone with the correct password can decrypt the message — not even this website can. Use a strong, unique password and share it through a different channel than the ciphertext.
Frequently asked questions
What makes this different from a simple cipher?
It uses AES in GCM mode, which is authenticated encryption — the payload carries a tag that detects any tampering. Decrypting a modified message fails outright rather than silently returning corrupted text, which is the failure mode of older unauthenticated modes.
Why do I need the same passphrase to decrypt?
Because the key is derived from it rather than stored. The salt and initialisation vector are random for every encryption and travel with the payload, so the same passphrase and ciphertext always reproduce the same key — but there is no way to recover the key from the payload alone.
Is it safe to paste real secrets here?
The encryption happens locally and nothing is transmitted, so the plaintext never leaves your browser. Even so, for genuinely sensitive material use a purpose-built tool such as age or GPG, and avoid pasting secrets into a web page on a machine you do not control.
Related Security & Cryptography Tools
You might also need
Tools from other categories that people pair with the AES Encrypt: