# AES Encrypt

> Encrypt and decrypt text with AES-256-GCM in the browser. A password is stretched with PBKDF2; output is Base64(salt + IV + ciphertext). Useful for sharing a short secret over a side channel you control. Keys never leave the tab.

Runs in your browser. Nothing is uploaded.

[Crypto](https://toolbuddy.dev/categories/crypto.md)

## About this tool

Encrypt and decrypt UTF-8 text with AES-256-GCM in Web Crypto. A password is stretched with PBKDF2 (SHA-256, 100k iterations, random 16-byte salt). Output is Base64 of salt + 12-byte IV + ciphertext so a single string is enough to decrypt later.

How to use: type a password, paste plaintext, Encrypt, copy the Base64. Decrypt with the same password. Wrong passwords fail authentication (GCM) instead of returning garbage. Empty password is rejected.

Example: a short note becomes a Base64 blob you can paste into a ticket you control. This is not a password manager, KMS envelope encryption, or a substitute for TLS. The sample password on this page is for demo only. Pick your own.

Keys are derived in the tab and never sent to ToolBuddy. Related: hash generator for digests, password generator for creating the passphrase. After load, encrypting works offline.

## FAQ

### Can I decrypt this elsewhere?

Yes, if the other side uses AES-256-GCM, the same PBKDF2 parameters (SHA-256, 100k iterations), and the packed layout salt(16) + IV(12) + ciphertext. Many generic 'AES' websites use different packing, so they will not decode this blob.

### Is this end-to-end encryption for production?

No. It is a local experiment tool. Use a real protocol (TLS, age, Signal, a KMS) for production secrets.

## Related Crypto tools

- [Hash Generator](https://toolbuddy.dev/tools/hash-generator.md): Generate cryptographic hashes (SHA-256, SHA-1, MD5, and more) from text using Web Crypto in your browser. Create checksums for files-as-text, compare digests, and copy hex output. Hashing never leaves the tab, so test strings and secrets stay private.
- [HMAC Generator](https://toolbuddy.dev/tools/hmac-generator.md): Compute HMAC-SHA signatures in the browser for webhook secrets and API signing. Paste a message and a key, pick SHA-1 through SHA-512, and copy hex or Base64. Keys stay in the tab.
- [JWT Decoder](https://toolbuddy.dev/tools/jwt-decoder.md): Decode JSON Web Tokens locally to inspect the header, payload, and expiry claims. Paste a JWT and read Base64URL-encoded fields without verifying signatures on a remote service. Ideal for debugging auth flows while keeping tokens off the network.
- [JWT Encoder](https://toolbuddy.dev/tools/jwt-encoder.md): Sign a JSON object into a compact HS256, HS384, or HS512 JSON Web Token in the browser. The HMAC secret stays in the tab, so you can mint a test token without posting it to a hosted encoder.
- [TOTP Generator](https://toolbuddy.dev/tools/totp-generator.md): Compute a time-based one-time password from a Base32 secret with HMAC-SHA, the same algorithm authenticator apps use (RFC 6238). Pick SHA-1, SHA-256, or SHA-512, 6 or 8 digits, and a 30- or 60-second step. The secret stays in the tab.
- [Secret Redactor](https://toolbuddy.dev/tools/secret-redactor.md): Redact JWTs, AWS keys, GitHub tokens, private keys, bearer tokens, and emails in pasted logs. Replacement happens in the tab.