AES text encrypt/decrypt

AES-256-GCM is an authenticated cipher: it both hides the content and detects tampering. Because AES needs a fixed-length key, your passphrase is first run through PBKDF2-SHA-256 with a random salt to derive a 256-bit key. A random 96-bit IV (nonce) is generated for every encryption so the same text and passphrase never produce the same ciphertext twice.

The output is a small JSON bundle containing the salt, IV, ciphertext and the GCM authentication tag. Decryption re-derives the key from that salt and verifies the tag before returning any plaintext.

1. Paste the text you want to protect and type a passphrase you can remember.
2. Choose Encrypt and copy the JSON payload that appears.
3. Store or send that payload. To recover the text, paste it back, enter the exact same passphrase and choose Decrypt.

The passphrase is the only secret — keep the JSON bundle wherever is convenient, since it is useless without the passphrase.

Use this for quick, one-off secrets: a note you want to email, a token you need to hand to a colleague, or a snippet you want to keep in plain sight but unreadable. For ongoing storage of many credentials, a dedicated password manager is better. For files and long-term archives, reach for GPG or age, which handle key management, recipients and large inputs.

• Passphrase strength is everything. AES-256 is unbreakable in practice, but a weak passphrase can be guessed. Use a long, random phrase.
• The payload format is specific to this tool. It is standard AES-GCM, but the JSON envelope is custom, so decrypt it here rather than expecting another library to read it as-is.
• Nothing is uploaded. Encryption, decryption and key derivation all happen in your browser via WebCrypto; close the tab when you are done with sensitive text.