Encrypt and decrypt text or files with AES-256, 192 or 128 in GCM, CBC or CTR mode. Free, instant, runs entirely in your browser.
This AES encryption tool lets you encrypt and decrypt text or files using the Advanced Encryption Standard directly in your browser. Choose a mode, choose a key size, type a password, and get ciphertext in seconds — no account, no installation, and no upload. Everything runs on the Web Crypto API built into your browser, so your plaintext, your password, and your files never leave your machine.
AES is the symmetric block cipher standardised by NIST in FIPS 197 and used almost everywhere modern software needs fast bulk encryption: TLS session traffic, full-disk encryption, encrypted database columns, password managers, and archive formats. If you are exploring a block cipher for the first time, testing an implementation against a reference, or building a payload for a Capture The Flag challenge, this tool gives you a fast, honest sandbox.
The tool implements three AES modes of operation and all three standard key lengths. Every combination is available for both encryption and decryption.
| Mode | Type | Authenticated | Notes |
|---|---|---|---|
AES-GCM | Counter + GMAC | Yes | Default and recommended. Uses a 12-byte IV and appends an authentication tag, so tampering is detected on decryption. |
AES-CBC | Cipher Block Chaining | No | Uses a 16-byte IV. Classic mode, still common in legacy systems. Provides confidentiality only. |
AES-CTR | Counter | No | Turns AES into a stream cipher. Uses a 16-byte counter block with a 64-bit counter length. |
Key sizes are 128, 192, and 256 bits. The key itself is never entered directly. Instead the tool derives it from your password with PBKDF2 using HMAC-SHA-256 and 100,000 iterations over a freshly generated 16-byte random salt. That is the same key-stretching pattern used by mainstream password-based encryption formats, and it is the reason a short password is still slow to attack offline.
encrypt or decrypt at the top of the tool.IV and salt, both in hex. Copy all three. To decrypt later you must supply the ciphertext, the password, the IV, the salt, and the same mode and key size.That last point is the single most common source of failed decryptions. AES is deterministic given a key and an IV, but the IV and salt here are random per encryption, so ciphertext alone is not enough. If any one of the five values is wrong, decryption fails and the tool reports an error rather than returning garbage.
An initialization vector makes identical plaintexts encrypt to different ciphertexts under the same key. Without it, an observer who sees two matching ciphertext blocks learns that the underlying plaintext blocks matched too — the classic weakness of raw ECB mode, which this tool deliberately does not offer. The tool generates a cryptographically random IV for every operation using crypto.getRandomValues().
The salt plays the same role one level up, at key derivation. Two people using the password correcthorse will derive completely different AES keys because their salts differ, which defeats precomputed rainbow tables. An IV is not secret and neither is a salt — both are normally stored alongside the ciphertext. Only the password must stay private.
A critical caveat for AES-GCM: never reuse the same key and IV pair for two different messages. GCM's security collapses catastrophically under nonce reuse, potentially exposing the authentication key itself. Because this tool generates a fresh random IV per operation, you get that guarantee automatically as long as you do not manually paste an old IV back in when encrypting.
No, and the numbers are worth internalising. A 256-bit key has 2256 possible values, roughly 1.16 × 1077. Suppose you had a machine capable of testing one trillion (1012) keys per second, and you built a billion of them, giving 1021 keys per second. Exhausting the keyspace would still take about 3.7 × 1048 years — some 1038 times the current age of the universe. AES-128 is dramatically smaller at 2128 keys, yet it too remains far beyond any feasible exhaustive search.
The best published cryptanalytic attacks against full AES, such as biclique cryptanalysis, shave the effective work factor by roughly two bits. That is an academically interesting result and an operationally meaningless one. Grover's algorithm on a large fault-tolerant quantum computer would halve the effective key length, which is precisely why AES-256 is still considered a sensible post-quantum choice while AES-128 is often reconsidered.
In practice AES is never the thing that breaks. Real compromises come from weak passwords, reused nonces, unauthenticated modes that permit padding-oracle or bit-flipping attacks, keys committed to source control, or plaintext left in logs and swap. If you are worried about the strength of the password feeding key derivation, run it through our password strength checker or generate a new one with the secure password generator.
Turning AES output back into readable text is decryption, not decoding — there is no way to recover plaintext from ciphertext without the key material. If you have Base64 or hex output and want to inspect its raw bytes without decrypting, that is a separate job for a Base64 encoder and decoder. If you only need a one-way fingerprint of some data rather than reversible encryption, use the hash generator instead.
AES-GCM in almost every case. It provides authenticated encryption, meaning it detects modified ciphertext instead of silently decrypting it into corrupted data. Choose CBC or CTR only when you must match an existing system that already uses them.
No. All encryption and decryption happens locally through the browser's Web Crypto API. Your plaintext, password, uploaded file, and resulting ciphertext are never transmitted to or stored by inventivehq.com.
Check all five inputs: ciphertext, password, IV, salt, and the mode plus key size combination. All must exactly match what was used at encryption time. Also confirm the input format selector matches how your ciphertext is actually encoded — feeding hex into a Base64 parser produces the wrong bytes.
Key length and round count. AES-128 uses 10 rounds, AES-192 uses 12, and AES-256 uses 14, so AES-256 is roughly 40 percent slower. Both are unbroken; AES-256 offers a wider margin against future cryptanalysis and quantum key search.
Yes. Drag a file onto the upload area or click to browse. Files up to 10 MB are encrypted byte-for-byte, and the output is returned as hex or Base64 along with the IV and salt.
AES is a block cipher operating on 128-bit blocks regardless of key size. Modes of operation change how those blocks are chained: CTR and GCM effectively turn AES into a stream cipher by encrypting a counter and XOR-ing the result with the data, which is why they need no padding.
No, and no tool can. Unlike a classical cipher such as the Caesar cipher, whose 25-key space is trivially exhausted, AES has no feasible brute-force path. This tool encrypts and decrypts with keys you supply; it does not recover unknown keys.
Yes, completely free with no sign-up, no usage limits, and no watermarking of output.
AES (Advanced Encryption Standard) is a symmetric block cipher adopted by the U.S. government in 2001 to replace the aging DES standard. Ratified as FIPS 197 by the National Institute of Standards and Technology (NIST), AES encrypts data in fixed 128-bit blocks using key sizes of 128, 192, or 256 bits. It remains the most widely deployed encryption algorithm in the world, securing everything from HTTPS connections and Wi-Fi networks to full-disk encryption and cloud storage.
AES was selected through a five-year public competition in which fifteen candidate algorithms were evaluated for security, performance, and implementation flexibility. The winning algorithm, Rijndael, was designed by Belgian cryptographers Joan Daemen and Vincent Rijmen.
AES operates through a series of transformation rounds applied to a 4x4 byte state matrix. The number of rounds depends on the key size:
| Key Size | Rounds | Security Level |
|---|---|---|
| 128-bit | 10 | Standard — suitable for most commercial applications |
| 192-bit | 12 | Enhanced — used by government agencies |
| 256-bit | 14 | Maximum — required for TOP SECRET classification |
Each round performs four operations:
| Mode | Type | Parallelizable | Authentication | Recommended |
|---|---|---|---|---|
| ECB | Block | Yes | No | Never use |
| CBC | Block | Decrypt only | No | Legacy only |
| CTR | Stream | Yes | No | With HMAC |
| GCM | Stream | Yes | Yes | Preferred |
| CCM | Stream | No | Yes | Constrained devices |
| SIV | Block | Encrypt no | Yes | Nonce-misuse resistant |
AES (Advanced Encryption Standard) supports multiple modes of operation. Each mode has different security properties and use cases.
How it works: Each plaintext block is XORed with the previous ciphertext block before encryption.
| Pros | Cons |
|---|---|
| Well-understood and widely supported | Requires random IV for each encryption |
| Errors don't propagate beyond one block | Cannot be parallelized for encryption |
| Good for file encryption | Vulnerable to padding oracle attacks if not implemented carefully |
Use for: File encryption, disk encryption, TLS (legacy)
How it works: Combines counter mode encryption with authentication using Galois field multiplication.
| Pros | Cons |
|---|---|
| Authenticated encryption (confidentiality + integrity) | IV/nonce must NEVER be reused with same key |
| Can be parallelized for high performance | Slightly more complex implementation |
| Detects tampering automatically | 12-byte nonce recommended |
Use for: TLS 1.3, API encryption, network protocols
How it works: Encrypts incrementing counter values, XORed with plaintext.
| Pros | Cons |
|---|---|
| Fully parallelizable | No built-in authentication |
| Random access to encrypted data | Nonce reuse is catastrophic |
| No padding required | Requires separate HMAC for integrity |
Use for: Streaming encryption, random access scenarios
Need authenticated encryption? → Use GCM
Legacy system compatibility? → Use CBC with HMAC
Streaming data? → Use CTR with separate authentication
Disk encryption? → Use XTS-AES (specialized mode)
| Mode | Requirement | Consequence of Reuse |
|---|---|---|
| CBC | Random IV, 16 bytes | Reveals if messages start the same |
| GCM | Unique nonce, 12 bytes | Complete security break |
| CTR | Unique nonce | Complete security break |
Critical: Never reuse a nonce/IV with the same key. Use cryptographically secure random number generators or counters.
AES (Advanced Encryption Standard) is a symmetric block cipher adopted by the U.S. government to protect classified information. It is considered one of the most secure encryption algorithms available and is widely used worldwide for protecting sensitive data. AES operates on fixed block sizes of 128 bits and supports key sizes of 128, 192, or 256 bits.
We recommend AES-GCM (Galois/Counter Mode) for most use cases. AES-GCM provides both encryption and authentication (AEAD), meaning it can detect if the ciphertext has been tampered with. AES-CBC is older and requires separate authentication, while AES-CTR operates as a stream cipher. For general-purpose encryption, GCM offers the best balance of security and performance.
The IV is a random value used to ensure that encrypting the same plaintext with the same key produces different ciphertext each time. This prevents pattern analysis attacks. The IV is not secret and can be stored alongside the ciphertext, but it must be unique for each encryption operation with the same key. Our tool automatically generates a cryptographically secure random IV.
This tool uses the Web Crypto API, which provides cryptographically secure operations directly in your browser. All encryption and decryption happens locally on your device - no data is ever sent to our servers. The Web Crypto API is built into modern browsers and uses the same cryptographic primitives as native applications.
The salt is a random value used with PBKDF2 to derive your encryption key from your password. Using a salt prevents attackers from using precomputed rainbow tables to crack passwords. You must save the salt along with the IV to decrypt your data later. Both values can be stored safely alongside your ciphertext as they do not reveal your password.
We recommend 256-bit keys for maximum security. While 128-bit AES is still considered secure against brute-force attacks, 256-bit provides a larger security margin and is required for some compliance frameworks. The key is derived from your password using PBKDF2 with 100,000 iterations, so the strength of your password is equally important.
Yes! This tool supports file encryption up to 10MB. Simply drag and drop a file or click to upload. The file is read into memory and encrypted using your chosen algorithm. The encrypted output can be copied as Base64 or hex. For larger files, consider using dedicated encryption software or our enterprise encryption services.