AES-GCM Encrypt / Decrypt
Encrypt and decrypt text with AES-GCM using a passphrase.
Sensitive data: Anything you enter is processed in your browser only. It is never uploaded or logged on a server.
AES-GCM encryption and decryption
AES-GCM provides authenticated encryption: tampering detection fails decryption when tags do not match. Passphrase-based demos derive keys with PBKDF2 and random IVs per message. IV reuse with the same key catastrophically breaks GCM security.
Never hard-code passphrases in repositories. Production systems should use KMS-managed keys with hardware security modules where available.
Ciphertext expansion includes authentication tag bytes. Store IV alongside ciphertext in databases; losing IV prevents decryption.
Encrypt sample data locally when prototyping formats. Production secrets should flow through audited key management, not browser demos.
Reference Guide
Security tool - all processing runs locally in your browser. No data is sent to a server.
Operation: aes-encrypt
- Enter plaintext in the primary field and a passphrase in secondary.
- Output is JSON with salt, IV, and ciphertext - copy it for decryption.
Paste input, click Run, and copy the result. For two-input tools, fill both fields before running.
Example Input
Sensitive note
Example Secondary Input
demo-passphrase
A sample loads automatically when you open this tool. Use Load Sample to reset it.