JSON to Query String
Serialise a JSON object into a percent-encoded URL query string.
AES Encrypt & Decrypt
Encrypt text with a password using AES-GCM, and decrypt it back.
Direction
Decryption needs the same password and the same iteration count. Mismatched iterations is the usual reason a correct password appears to fail.
Quick Tool Overview
The AES tool encrypts text with a password using AES-256-GCM, stretching the password with PBKDF2 first. GCM is authenticated, so a tampered ciphertext is refused rather than decrypting to plausible garbage.
- What it does
- Encrypts and decrypts text with a password
- You give it
- Text and a password
- You get back
- A self-contained ciphertext string
- Best for
- Passing a note through an untrusted channel
About the AES Encrypt & Decrypt
Encrypt a piece of text with a password and get back a single string you can send or store. The password is stretched with PBKDF2 over many iterations before it becomes a key, because a password on its own is nowhere near enough entropy for AES.
AES-GCM is authenticated, which is the part that matters. It does not only hide the content; it detects any change to the ciphertext and refuses to decrypt rather than returning plausible garbage. The output carries its own random salt and IV, so one string holds everything needed to decrypt it later — given the password and the same iteration count. Everything runs through the browser's own crypto implementation, not a JavaScript reimplementation of AES.
Key features of the AES Encrypt & Decrypt
Authenticated encryption
AES-GCM detects any change to the ciphertext and refuses to decrypt, rather than returning something that looks like data.
PBKDF2 key stretching
The password is stretched over hundreds of thousands of iterations, because a password alone has nothing like enough entropy for AES.
Self-contained output
The random salt and IV travel inside the ciphertext, so one string is all you need to keep.
The browser’s own AES
Encryption goes through SubtleCrypto, not a JavaScript reimplementation — which would be both slower and less safe.
Clear failure messages
A failed decryption explains the three possible causes, since GCM itself cannot distinguish between them.
How to use the AES Encrypt & Decrypt
-
1
Choose encrypt or decrypt
The same password and iteration count are needed for both directions.
-
2
Enter your text and password
A long passphrase beats a short complicated one.
-
3
Set the iteration count
Higher is slower to attack and slower to use. The default is a reasonable balance.
-
4
Copy the result
The ciphertext carries its own salt and IV, so nothing else needs recording.
Frequently asked questions
The cryptography is sound — AES-256-GCM with PBKDF2 through the browser's own implementation. The weak point is the password and the fact that you are typing it into a web page. For anything genuinely sensitive, use a password manager or age or GPG.
Three possible reasons and GCM cannot tell you which: the password is wrong, the iteration count differs from the one used to encrypt, or the ciphertext was altered. Check the iteration count first — it is the one people forget.
The salt makes the derived key different even for the same password, defeating precomputed tables. The IV makes the ciphertext different every time. Both are random, both are stored in the output, and neither is secret.
Because the salt and IV are regenerated on each encryption. That is required for security — a fixed IV in GCM is catastrophic — and it means you cannot compare two ciphertexts to see if the plaintexts match.
Reviews of the AES Encrypt & Decrypt
What people who use the AES Encrypt & Decrypt think of it. Reviews come from visitors and are posted as written.
No ratings yet
Yours would be the first.
- 5 0 reviews rated 5 stars
- 4 0 reviews rated 4 stars
- 3 0 reviews rated 3 stars
- 2 0 reviews rated 2 stars
- 1 0 reviews rated 1 star
0 reviews
Newest first
No reviews yet
Be the first to rate the AES Encrypt & Decrypt. It takes half a minute and no account.
Write the first reviewMore developer tools
JSON to Java Class
Generate Java POJOs or records with Jackson annotations from JSON.
JSON Validator
Check JSON syntax and get the exact line, column and cause of any error.
API Key Generator
Generate prefixed API keys in the format modern providers use.
Fake Data Generator
Generate realistic test rows in JSON, CSV or SQL from fields you choose.
Text Shadow Generator
Build text shadows, outlines and glows with a live preview.
HTML to Markdown
Convert HTML back into clean Markdown, keeping lists, tables and code.
CORS Header Generator
Generate correct CORS headers, and understand why the request was blocked.