About this AES encryption tool
This page encrypts and decrypts text with AES, the Advanced Encryption Standard, using a passphrase you choose. Everything happens in your browser through the built-in Web Crypto API. The text and the passphrase are never sent to a server, and the page keeps working with the network switched off once it has loaded.
How the output is built
The tool uses AES in CBC mode with PKCS#7 padding, the same layout as openssl enc -aes-256-cbc -a and as the default of CryptoJS (CryptoJS.AES.encrypt(text, passphrase)). A random 8-byte salt is generated for every encryption, the key and the IV are derived from your passphrase and that salt, and the result is the ASCII marker Salted__, then the salt, then the ciphertext, all Base64 encoded. A string that starts with U2FsdGVkX1 in Base64 is exactly this format. Because the salt is random, encrypting the same text twice gives two different outputs, and both decrypt to the same text.
Which key derivation to pick
The default, EVP_BytesToKey with MD5, is what CryptoJS and old OpenSSL use, so it is the one to choose when you need to match another tool. It is fast, which also makes a weak passphrase easy to guess offline. The PBKDF2 option derives the key and IV with PBKDF2 and SHA-256 and an iteration count you set (100,000 by default). It matches openssl enc -aes-256-cbc -pbkdf2 -iter 100000 -md sha256, and you must enter the same count to decrypt. Prefer it whenever both sides can use it.
Wrong passphrase
CBC mode has no built-in way to check a passphrase. The tool reports an error when the final padding block or the UTF-8 text is invalid, which is what happens almost every time the passphrase is wrong. About one wrong attempt in 256 can pass the padding check by chance; the text will then be unreadable, and the tool still refuses it as invalid UTF-8 in nearly every case.
Honest limits
- CBC does not authenticate the message. Anyone who can change the ciphertext can flip bits in the result without knowing the passphrase. For stored secrets, use an authenticated mode such as AES-GCM in your own code.
- Security depends on the passphrase. Use a long, random one, and share it by a different route than the ciphertext.
- Text only. Files and binary input are not handled here.
- This is a convenience tool, not a vault. Nothing is saved, so keep the passphrase yourself; there is no recovery.
Test it
Encrypt hello world with the passphrase secret, copy the result, switch to Decrypt, paste it and run it again. You get hello world back. The same Base64 text decrypts with the OpenSSL command line or CryptoJS using the same passphrase.
Frequently asked questions
The text and passphrase stay in your browser and are not transmitted, so the page itself does not expose them. The strength of the result depends on your passphrase and on how you share it. Treat the output as protected only as far as the passphrase is.
Yes, with the default key derivation. The output is the Salted__ format in Base64, which CryptoJS.AES.decrypt and openssl enc -d -aes-256-cbc -a -md md5 can read, and this page can decrypt strings made by them. Match the key size on both sides.
A fresh random salt is created for every encryption, and the salt changes the derived key and IV. That is intended: it stops identical messages from producing identical ciphertext.
You see an error that says the passphrase is wrong or the data is damaged, not random characters. Padding or text validation fails in almost every wrong-passphrase case, and the tool reports it.
Use PBKDF2 when both ends support it, because it is far slower to brute force. Use the MD5 default only to interoperate with CryptoJS and older OpenSSL output.
No. This tool handles text only. Encode the file as Base64 first if you must, but a dedicated file encryption tool is a better fit for large data.