Is data sent to a server?

No. AES-GCM and PBKDF2 run locally via the Web Crypto API.

Ciphertext cannot be recovered without the key or a break of AES—back up passphrases.

Is this for production apps?

Use audited libraries and key management; this page is for education and quick local tasks.

GCM provides confidentiality and integrity; tampered ciphertext should fail to decrypt.

PBKDF2 parameters matter for brute-force resistance; defaults should be documented on-page.

This flow targets text; encode binary as Base64 first if you must experiment.

Password-based AES-GCM (256-bit) with PBKDF2 key derivation; encrypt or decrypt text locally.

ModePassword

Encrypted payload (JSON)

—

Informational only; verify critical results independently.

Choose a strong passphrase you can store in a password manager.
Paste short text to encrypt, or paste ciphertext plus IV/tag blob to decrypt.
Run Encrypt; copy the full output including any nonce/IV the tool displays.
To decrypt later, paste ciphertext and enter the same passphrase exactly.
Never email keys in plaintext; share secrets out-of-band if you must.
Rotate passphrases by decrypting with the old key and re-encrypting with a new one.

Is data sent to a server?: No. AES-GCM and PBKDF2 run locally via the Web Crypto API.
Forgot password?: Ciphertext cannot be recovered without the key or a break of AES—back up passphrases.
Is this for production apps?: Use audited libraries and key management; this page is for education and quick local tasks.
Authenticated encryption?: GCM provides confidentiality and integrity; tampered ciphertext should fail to decrypt.
Key derivation iterations?: PBKDF2 parameters matter for brute-force resistance; defaults should be documented on-page.
Binary files?: This flow targets text; encode binary as Base64 first if you must experiment.

Last updated: 2025-11-09