Can I decrypt this elsewhere?

Yes, if the other side uses AES-256-GCM, the same PBKDF2 parameters (SHA-256, 100k iterations), and the packed layout salt(16) + IV(12) + ciphertext. Many generic 'AES' websites use different packing, so they will not decode this blob.

Is this end-to-end encryption for production?

No. It is a local experiment tool. Use a real protocol (TLS, age, Signal, a KMS) for production secrets.

In Browser

AES Encrypt

Encrypt and decrypt text with AES-256-GCM in the browser. A password is stretched with PBKDF2; output is Base64(salt + IV + ciphertext). Useful for sharing a short secret over a side channel you control. Keys never leave the tab.

Runs in your browser. Nothing is uploaded.Ctrl+Enter to process

Loading tool…

About this tool

Encrypt and decrypt UTF-8 text with AES-256-GCM in Web Crypto. A password is stretched with PBKDF2 (SHA-256, 100k iterations, random 16-byte salt). Output is Base64 of salt + 12-byte IV + ciphertext so a single string is enough to decrypt later.

How to use: type a password, paste plaintext, Encrypt, copy the Base64. Decrypt with the same password. Wrong passwords fail authentication (GCM) instead of returning garbage. Empty password is rejected.

Example: a short note becomes a Base64 blob you can paste into a ticket you control. This is not a password manager, KMS envelope encryption, or a substitute for TLS. The sample password on this page is for demo only. Pick your own.

Keys are derived in the tab and never sent to ToolBuddy. Related: hash generator for digests, password generator for creating the passphrase. After load, encrypting works offline.

FAQ

Related Crypto tools

Hash Generator

Generate cryptographic hashes (SHA-256, SHA-1, MD5, and more) from text using Web Crypto in your browser. Create checksums for files-as-text, compare digests, and copy hex output. Hashing never leaves the tab, so test strings and secrets stay private.

HMAC Generator

Compute HMAC-SHA signatures in the browser for webhook secrets and API signing. Paste a message and a key, pick SHA-1 through SHA-512, and copy hex or Base64. Keys stay in the tab.

JWT Decoder

Decode JSON Web Tokens locally to inspect the header, payload, and expiry claims. Paste a JWT and read Base64URL-encoded fields without verifying signatures on a remote service. Ideal for debugging auth flows while keeping tokens off the network.

Secret Redactor

Redact JWTs, AWS keys, GitHub tokens, private keys, bearer tokens, and emails in pasted logs. Replacement happens in the tab.