AES Encryption & Decryption Online — CBC, ECB, CTR and GCM
Encrypt and decrypt with AES-128 or AES-256 using your own key and IV — or just a password.
🔒 Runs in your browser — files never uploaded ⚡ No signup 💯 Free
Same thing with OpenSSL
Encrypts with AES-256-GCM using a key derived from the password (PBKDF2, 310,000 rounds). There is no recovery: lose the password and the message is gone for good.
Standard AES encryption and decryption with the key and IV you choose: CBC, ECB, CTR or GCM, 128- or 256-bit keys, input and output as text, hex or Base64, with PKCS#7 or no padding. The results match OpenSSL, Python's cryptography, Node's crypto, Java's Cipher and every other correct AES implementation, so you can check your code against it or decrypt data another program produced. Each result also comes with the equivalent openssl command.
Just want to protect a message? The Password tab does it in one step, with AES-256-GCM and a key derived from your password. Everything runs in your browser on its built-in Web Crypto: no text, key or password is ever sent anywhere.
How to use AES Encrypt / Decrypt
- Choose Encrypt or Decrypt, then the mode, padding and key size. CBC with PKCS#7 is the most common combination.
- Enter the key and IV in hex, text or Base64, or click Random. The byte counters turn green when the lengths are right: 16 or 32 bytes for the key, 16 for the IV (12 for GCM).
- Paste the input and pick its format. Plaintext can be text, hex or Base64; ciphertext is Base64 or hex.
- Click Encrypt or Decrypt and copy the result. Open "Same thing with OpenSSL" for the matching command line.
Which AES mode?
- CBC (cipher block chaining) is the classic mode and the most likely one if you are matching another system: each block is mixed with the previous one, starting from a 16-byte IV. It needs padding, and it does not detect tampering on its own.
- ECB encrypts every 16-byte block independently with no IV. It is here because old systems and coursework use it, but avoid it for anything real: identical plaintext blocks give identical ciphertext blocks, so patterns in the data show straight through.
- CTR (counter) turns AES into a stream cipher: no padding, and the ciphertext is exactly as long as the plaintext. The 16-byte IV is the starting counter, incremented as one 128-bit number, the same way OpenSSL does it.
- GCM is the modern choice. It encrypts like CTR and adds a 16-byte authentication tag to the end of the ciphertext, so a wrong key or a single altered byte makes decryption fail instead of returning garbage. The nonce is normally 12 bytes.
Keys and IVs
An AES key is exactly 16 bytes (AES-128) or 32 bytes (AES-256). A key written in hex is twice as many characters (32 or 64), and a text key must be exactly 16 or 32 characters of plain ASCII. This tool will not quietly pad or cut a key to fit, as some sites do: that silently produces ciphertext no other program can decrypt. A text key is also much weaker than a random one, because it is limited to characters people type. For real use, click Random and store the hex.
The IV does not need to be secret, but it must never repeat with the same key. Send it along with the ciphertext; a common convention is to put it in front. Reusing a GCM nonce is especially dangerous: it can expose the authentication key and the XOR of the two messages.
AES-192 (24-byte keys) is not offered, because browsers' Web Crypto does not support it.
Padding: PKCS#7 or none
CBC and ECB work on whole 16-byte blocks, so the plaintext is padded first. PKCS#7 adds N bytes of value N (from 1 to 16) and is what nearly every library uses by default. Java calls it PKCS5Padding; for AES the two are identical. Choose None only when the data is already a multiple of 16 bytes and the other side expects no padding, as in the NIST test vectors.
Matching another program
Mode, key, IV, padding and encoding must all match exactly; one difference gives a "bad padding" error or unreadable output. The usual culprits are: a key typed as text when the other side used hex; Base64 versus hex output; the IV placed in front of the ciphertext by the other program (split it off: the first 16 bytes are the IV); and GCM libraries that return the tag separately (append it to the ciphertext here). In Java, AES/CBC/PKCS5Padding is CBC with PKCS#7 here, and AES/ECB/NoPadding is ECB with no padding.
Password mode
The Password tab is for people, not programs: type a message and a password, and get back one block of text to send. Under the hood the password goes through PBKDF2-SHA256 with 310,000 iterations (the OWASP figure), a random salt and nonce are generated for every message, and the result is AES-256-GCM, packed into a single Base64 block. A wrong password fails cleanly. There is no recovery: the password is the only key, so keep it in a password manager and send it by a different route than the message.
Frequently asked questions
Is my text or key sent to your server?
No. Encryption and decryption run in your browser with its built-in Web Crypto. The text, key, IV and password never leave the page, and nothing is stored.
Why do I get "bad padding" when decrypting?
Almost always because something does not match the encryption: the key (or its format — text vs hex), the IV, the mode, or the padding setting. With CBC and ECB a wrong key cannot be detected directly; it shows up as invalid padding. Check each setting against the program that encrypted the data.
Does this match OpenSSL, Python and Java?
Yes. It is standard AES with standard padding, checked against the NIST test vectors and OpenSSL. Open "Same thing with OpenSSL" under the result for the exact command; in Java, AES/CBC/PKCS5Padding corresponds to CBC + PKCS#7 here.
Is AES ECB mode secure?
Not for real data. ECB encrypts identical blocks to identical ciphertext, so patterns leak. It is offered for compatibility with old systems and for learning. For new work use GCM, or CBC with a random IV plus a separate integrity check.
What is the difference between PKCS#5 and PKCS#7 padding?
For AES there is none in practice. PKCS#5 was defined for 8-byte blocks and PKCS#7 generalises it; libraries such as Java use the name PKCS5Padding for what is really PKCS#7 on 16-byte AES blocks.
Where is the GCM authentication tag?
Appended to the end of the ciphertext, 16 bytes — the same layout Web Crypto, Go and Python's AESGCM use. If your library returns the tag separately (as Node and the OpenSSL C API do), concatenate ciphertext + tag before decrypting here.
Why is AES-192 not available?
Browsers' Web Crypto, which this tool is built on, supports only 128- and 256-bit AES keys. AES-192 is rarely used; AES-256 is the usual choice when you want more than 128 bits.
I lost the key or password — can the data be recovered?
No. AES has no back door and this site keeps nothing. Without the exact key (or, in Password mode, the exact password) the data cannot be decrypted by anyone.