AES Encrypt / Decrypt — GCM, CBC, CTR and ECB in Your Browser
AES Encrypt / Decrypt
Encrypt or decrypt with AES-128, AES-192 or AES-256
(FIPS 197) in GCM (authenticated encryption), CBC, CTR or
ECB mode. Keys are raw hex or Base64 bytes, or derived from a password with
PBKDF2-HMAC-SHA256. GCM supports AAD and shows the authentication tag separately; CBC/CTR/ECB
outputs are OpenSSL enc-compatible. For hashes see the
Hash Generator, for keyed MACs the
HMAC Generator, for legacy ciphers the
Legacy Ciphers page in this family.
Runs entirely locally — keys and plaintext never leave your tab. Files up to 200 MB.
Everything typed here stays in this tab — but that is not the same as “safe for production secrets.”
Browser memory, extensions and shoulder-surfers see what you paste. Use this page to learn, verify and interoperate, not to handle live customer data.
Direction:Mode:Output:
GCM = AES-GCM with a 12-byte nonce and a 128-bit authentication tag (AEAD: confidentiality + integrity). Default when security is the goal.
Key (raw bytes: 16, 24 or 32 bytes = AES-128/192/256; the length of what you paste decides)
Hex tolerates spaces, colons and 0x prefixes.
Salt (hex, 8–16 bytes):
Iterations:Key size:
The salt travels with the ciphertext - whoever decrypts needs the same password, salt, iteration count and key size. OWASP recommends at least 600,000 PBKDF2-HMAC-SHA256 iterations.
Never reuse a nonce under the same key in GCM or CTR.
AAD (additional authenticated data — authenticated but not encrypted, optional)
Tag length:
Authentication tag (hex, as printed by this page on encrypt — required to decrypt)
Plaintext text (the data to encrypt, UTF-8 encoded)
Choose a file or drag and drop it here
The file is read locally in 8 MB chunks; nothing is uploaded. Up to 200 MB.
Ciphertext (one line: mode, key size, value; parameters on the lines below)
The parameter lines record the exact key reading, IV, AAD size and tag, so a copy-pasted result can always be reproduced on another machine.
Which mode should I pick? GCM is the default answer: it encrypts and authenticates — the tag line makes tampering detectable (try decrypting with a flipped tag byte and the page refuses). CBC hides block patterns but provides no integrity; pair it with an HMAC (see the HMAC Generator) if you must use it. CTR turns AES into a stream cipher — no padding, but a reused nonce under the same key is catastrophic in both CTR and GCM. ECB is here for compatibility and teaching only: identical plaintext blocks encrypt to identical ciphertext blocks (the famous ECB penguin).
OpenSSL interop — CBC and CTR outputs from this page (PKCS#7 padding, raw key) round-trip with the openssl enc command line: openssl enc -aes-256-cbc -K <64-hex-key> -iv <32-hex-iv> -in msg.txt -out msg.enc openssl enc -d -aes-256-cbc -K <key> -iv <iv> -in msg.enc -out msg.txt
The same works with -aes-128-cbc, -aes-192-cbc, -aes-256-ctr (16-byte IV = initial counter block). Note openssl enc does not support GCM — use this page, or openssl aesgcm from OpenSSL 3.3+, for authenticated encryption.
Need the Chinese national cipher instead?
SM4 (GB/T 32907-2016) — the block cipher mandated in Chinese commercial cryptography, with
the same 128-bit block and key size as AES but its own key schedule and S-box — runs on its
own page in ECB and CBC mode: SM4
Encrypt / Decrypt. The rest of the SM suite lives there too:
SM3 (hash),
SM2 (public key) and
SM9 (identity-based crypto).
Self-test
Runs the page engines against independent anchors: known-answer vectors for all four modes (generated by an independent native implementation), GCM tag vectors with and without AAD, cross-checks of the WebCrypto engine against the pure-JS AES engine, GCM roundtrip, and negative tests (tampered tag, wrong key must fail). Nothing is sent anywhere.
AES encryption explained from scratch
In one sentence: AES is the worldwide-standard block cipher — it scrambles 16-byte blocks under a 128, 192 or 256-bit key — and the mode you run it in (GCM, CBC, CTR, ECB) decides how those blocks are chained, what the IV is for, and whether tampering is detectable; pick GCM unless you have a reason not to.
What AES itself is (FIPS 197)
The block cipher. AES (the Rijndael design, standardized by NIST in 2001 as FIPS 197) encrypts exactly 16 bytes at a time. Your key length — 16, 24 or 32 bytes — selects AES-128, -192 or -256 and the number of internal rounds (10, 12, 14). Each round mixes the block with round keys derived from your key through substitution tables, row shifts and column mixes. No practical attack breaks the cipher itself: the real-world failures are almost always mode, IV or key-management mistakes, which is what the rest of this page is about.
Why a mode at all? Because messages are rarely 16 bytes. The mode glues block encryptions together: ECB just encrypts blocks independently; CBC XORs each block with the previous ciphertext; CTR encrypts a counter and XORs it with the data like a stream cipher; GCM builds on CTR and adds a authentication tag. AES stays the same — the mode changes everything about the guarantees you get.
Keys and passwords. An AES key is 16, 24 or 32 random bytes. A human password is not that: this page’s Password option derives a proper key with PBKDF2-HMAC-SHA256 (600,000 iterations by default, the OWASP 2023 baseline — see the HMAC Generator for the KDF details). Never use a password string directly as an AES key: its entropy is a small fraction of its length.
The four modes compared
Mode
IV / nonce
Integrity
Notes
GCM
12 bytes, unique per message
Yes — 96..128-bit tag
AEAD: the recommended default everywhere (TLS 1.3, SSH, file formats). Also accepts AAD.
CBC
16 bytes, unpredictable
No
PKCS#7 padding; classic but needs a MAC alongside. Padding-oracle bugs are the classic CBC pitfall.
CTR
16-byte initial counter
No
No padding, stream-like, random access; nonce reuse under one key leaks plaintext XOR plaintext.
ECB
none
No
Identical blocks → identical ciphertext. The ECB-penguin demonstration. Compatibility only.
IV rules in one paragraph. The IV is not a secret — send it next to the ciphertext — but its uniqueness rules differ: CBC wants an unpredictable IV; GCM and CTR only demand never reuse the same nonce with the same key (GCM nonce reuse is worse: it leaks the authentication key). This page’s Random IV button uses the browser’s secure RNG; the All-zeros button exists for reproducing test vectors, not for real messages.
Padding. CBC and ECB need whole blocks, so PKCS#7 padding appends 1..16 bytes each equal to the pad length. That is why CBC ciphertexts grow up to 16 bytes and why decrypting with the wrong key usually fails with a padding error. CTR and GCM are stream-like and need no padding — ciphertext length equals plaintext length exactly (try the Sample in CTR mode: 43 bytes in, 43 bytes out).
CFB and OFB (the two remaining classic modes) are not implemented on this page: they are stream-like like CTR but with no advantage over it, and mostly survive in old protocols.
What GCM adds (AEAD, tags, AAD)
Authenticated encryption. GCM = CTR encryption + a GHASH authenticator over the ciphertext, the IV and the AAD. The output tag is a fingerprint of everything: change one bit of ciphertext, IV or AAD and the tag no longer matches, so the receiver can prove the message is intact and from a key-holder. CBC+HMAC achieves the same only if you compose it correctly (encrypt-then-MAC) — GCM gets it right by construction.
AAD. Additional authenticated data travels in the clear but is covered by the tag: protocol headers, file names, algorithm identifiers. The receiver must supply the identical AAD bytes or the tag check fails — that is the point.
Tag length. The default 128-bit tag is the recommendation; shorter tags (96..120 bits) trade forgery resistance for size. Below 96 bits GCM’s security proofs degrade quickly, which is why this page stops there.
The nonce catastrophe. Reusing a 12-byte GCM nonce under the same key leaks the plaintext XOR of the two messages and the authentication subkey — after which forgeries are possible for all future messages under that key. Systems that cannot guarantee uniqueness use nonce-misuse-resistant variants (AES-GCM-SIV, RFC 8452).
Anchor values — reproduce them on this page
The first row is the famous single-block FIPS 197 example; the rest were generated by an independent native implementation (OpenSSL via Node.js) and re-verified on this page’s engines. Paste the key, IV and input into the page to reproduce each line.
Case
Inputs
Expected output
AES-128 single block (FIPS 197 style)
key 000102..0f, plaintext 00112233..ff
69c4e0d86a7b0430d8cdb78070b4c55a
AES-128-GCM
key 000102..0f, IV 606162..6b, plaintext 0011..ef ×2
ct 275f095bedfda377063fee326128892188377b410698ed03a022b9971bb4bdbe, tag 87ea7770714048977de2fd8dac645ecf
AES-256-GCM, same but AAD deadbeef
key 000102..1f
ct eacab966ff15e518f48f5390be502fbc2756ccee0dcfff36a282c50bf5593ae7, tag aead900e895c88252d0388d7aefce5c8
AES-256-CBC
key 000102..1f, IV 101112..1f, plaintext 0011..ef ×2
Using ECB because it needs no IV. The convenience is the trap: block patterns leak straight into the ciphertext (encrypt a bitmap and you can still see the picture). ECB is acceptable only for single blocks or exactly-16-byte random keys — in practice, never by choice.
Reusing a nonce/IV. With GCM or CTR under one key it is the one mistake that breaks everything at once. Counter-based systems (this page’s Random IV button) exist to make it impossible.
Treating the IV as secret. It is not. Store or transmit it next to the ciphertext. Hiding it buys nothing and tempts reuse.
Using a password as the key."hunter2hunter2hunter2hunter2" is 32 bytes but not 256 bits of entropy — it is a dictionary word with padding. Derive with PBKDF2 (built into this page) or generate a random key.
Assuming CBC detects tampering. Flip a bit in CBC ciphertext and decryption “succeeds” with silently corrupted plaintext. Only GCM’s tag (or an explicit HMAC) makes tampering visible.
Comparing GCM ciphertexts for equality. With random nonces the same plaintext encrypts differently every time — that is a feature. Deterministic encryption is a different, specialized tool.
FAQ
Is AES-128 still safe, or do I need 256? Both are secure against realistic attackers; the best known attacks shave only a fraction of the margin. AES-256 matters mainly for long-term secrets and post-quantum comfort (Grover’s algorithm halves key strength, leaving AES-256 at ~128-bit equivalent).
Why doesn’t openssl enc do GCM? The enc command predates AEAD and has no way to carry a tag; OpenSSL 3.3 added a dedicated aesgcm command instead. This page’s GCM output keeps the tag on its own line so you can move both around explicitly.
What is key wrapping (AES-KW)? A specialized mode for encrypting other keys with fixed 64-bit chunks and its own integrity check. It is not offered here because its inputs and outputs are key-shaped, not message-shaped — misuse is the norm.
Why is my CTR ciphertext the same length as the plaintext, but CBC’s is longer? CTR and GCM are stream-like (no padding); CBC/ECB pad to a whole 16-byte block with PKCS#7. The length difference is by design, not a bug.
Can I decrypt something encrypted elsewhere? Yes, if you know the exact mode, key, IV (and for GCM the tag). This page’s output lines record all of them precisely so you can port parameters between tools — the OpenSSL box above shows the matching command lines.
