AES Encrypt / Decrypt — Encrypt text with a password and paste the result into an email, a chat, or a file. The recipient decrypts with the same password.
Encryption and decryption run in your browser. The password and the message never leave the page.
Was AES Encrypt / Decrypt useful?
What is AES Encrypt / Decrypt?
Encrypt text with a password and paste the result into an email, a chat, or a file. The recipient decrypts with the same password.
Encryption is AES-256-GCM (authenticated, so tampering is detected). Keys are derived from the password with PBKDF2-SHA256 and 250,000 iterations. Everything runs in your browser — the password and the message never reach a server.
How to use it
-
Choose encrypt or decrypt
Two modes. Same password field, different input and output sides.
-
Pick a strong password
A random 20-character string is the right pick for sensitive data. Use the password generator if you do not have one.
-
Encrypt or decrypt
The result is a portable text envelope you can paste anywhere.
Examples
Send a one-time secret in an email
Encrypt a password, a token, or a short message with a passphrase. Send the ciphertext in an email, share the passphrase by phone. The recipient pastes the ciphertext, enters the passphrase, and gets the original.
Plaintext: "Meeting at 3pm, use the back door" Password: "blue-river-42"
Result: A v1:base64... envelope that decrypts only with "blue-river-42".
Encrypt a note for yourself
Store a ciphertext in a note-taking app, a password manager, or a file. Decrypt it from any device with the password. Useful for API keys, recovery codes, or anything you do not want in plaintext.
Plaintext: an API key Password: a strong password you remember
Result: The ciphertext is safe to store. Only the password unlocks it.
Frequently asked questions
Related guides
How to Encrypt a Message with a Password (in Your Browser)
A practical guide to password-based encryption: how AES-GCM with PBKDF2 actually works, why the wire format matters for future compatibility, the common foot-guns (weak passwords, no integrity check, ECB mode), and how to encrypt a message in your browser without trusting a remote service with the plaintext.
The Myth of the Secure Password in 2026 (and What Actually Matters)
A "secure" password is no longer the bottleneck. The bottleneck is everything around the password. Here is what the threat model actually looks like in 2026, why a 16-character random password is not enough on its own, and the four things that actually keep you safe.
MD5 vs SHA-1 vs SHA-256 vs SHA-3: When to Use Each Hash Function
A practical guide to cryptographic hash functions: what a hash is for, the four real-world choices (MD5, SHA-1, SHA-256, SHA-3), the speed vs. security trade-offs, the deprecation timeline, and which one to use for each common use case.
Related tools
Password Generator
Create strong, random passwords with custom length and character sets — right in your browser.
Password Strength Checker
See how strong a password really is — entropy, time-to-crack, and a list of issues, all computed in your browser.
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes of any text instantly.
JWT Decoder
Decode a JWT’s header and payload and check its expiration — without sending it anywhere.
Base64 Encoder
Encode any text — including emoji and non-Latin scripts — into standard Base64.
Base64 Decoder
Decode Base64 back into readable text, with clear errors for malformed input.
URL Encoder
Percent-encode text for safe use in URLs — as a query value or a full URL.
Last reviewed: 2026-10-01