AES Encryption & Decryption
Encrypt text or files with AES-256 and a password. Runs in your browser.
About this aes encryption & decryption
This tool encrypts and decrypts text or files with AES-256-GCM and a password, right in your browser. Use it to protect a note, a config file or a document before you email it or put it in cloud storage.
You only need to remember the password. The tool derives the key with PBKDF2-SHA-256 at 600,000 iterations, picks a random salt and IV, and packs everything needed to decrypt into one Base64 string or one .enc file. Paste it back with the same password and you get your data.
There is also a Raw key / OpenSSL tab for developers. It opens AES-CBC, AES-CTR and AES-GCM data when you have the key and IV in hex or Base64, and it decrypts the "Salted__" output of openssl enc and CryptoJS.
Features
AES-256-GCM with authentication
GCM checks a 16-byte tag on decrypt. A wrong password or a single changed byte gives a clear error instead of garbage output.
Password-based key, done properly
PBKDF2-HMAC-SHA-256 with 600,000 iterations by default and a fresh 16-byte salt for every message. You can raise or lower the count.
Self-describing output
The version, iteration count, salt and IV travel inside the output. You never have to copy or remember them separately.
Text and file modes
Encrypt any file up to 512 MB to name.enc, then decrypt it back to the original name. Text mode gives Base64 you can paste into a chat or email.
Interop with other tools
Decrypt AES-CBC (PKCS#7), AES-CTR or AES-GCM with a raw 128, 192 or 256-bit key, or encrypt test vectors to compare against your own code.
Opens OpenSSL and CryptoJS data
Paste a U2FsdGVkX1… string, enter the passphrase and choose PBKDF2 (openssl -pbkdf2) or MD5 (CryptoJS and older openssl).
Web Crypto only
Encryption uses the browser's built-in Web Crypto API. Your password, keys and data never leave the page.
How to use the aes encryption & decryption
- 1Choose Encrypt or Decrypt, then Text or File.
- 2Enter a password. Iterations, salt and IV are handled for you.
- 3Copy the Base64 result or download the .enc file. Decrypt with the same password.
When to use it
Send a secret over email or chat
Encrypt the text, send the Base64, and share the password another way, such as a phone call. Anyone who sees only the message learns nothing.
Protect a file in cloud storage
Encrypt a tax PDF or a spreadsheet before you upload it. The storage provider only ever holds the .enc file.
Debug an encryption bug
Your backend encrypts with AES-CBC and the app can't decrypt. Paste the key, IV and ciphertext here to see which side is wrong.
What is AES-256-GCM?
AES is the Advanced Encryption Standard, published by NIST as FIPS 197 in 2001. It encrypts 16-byte blocks with a 128, 192 or 256-bit key. AES-256 uses the longest key, and no practical attack against it is known.
GCM (Galois/Counter Mode, NIST SP 800-38D) turns AES into a stream cipher and adds an authentication tag. That tag is why you get "wrong password" instead of random bytes. Older modes like CBC have no tag, so a wrong key often decrypts into nonsense without any warning.
How does password-based encryption work here?
A password isn't a key. AES needs exactly 32 random-looking bytes, so the tool stretches your password with PBKDF2. It runs HMAC-SHA-256 600,000 times with a random salt, the setting OWASP recommends for PBKDF2-SHA-256 in 2023 and later.
That stretching takes a fraction of a second for you and makes every guess just as slow for an attacker. It still can't save a short password. A random 4-word passphrase or a 16-character generated password is a good minimum.
What is in the encrypted output?
The output is a small binary container. Text mode shows it as standard Base64, which is why it always starts with TVZSU. File mode saves the same bytes as .enc. You can inspect the Base64 with the Base64 decoder.
- Bytes 0 to 3: the magic "MVRS".
- Byte 4: format version, currently 1.
- Byte 5: algorithm id. 1 means AES-256-GCM with a PBKDF2-HMAC-SHA-256 key.
- Bytes 6 to 9: the PBKDF2 iteration count, big-endian.
- Bytes 10 to 25: the 16-byte random salt.
- Bytes 26 to 37: the 12-byte random IV (nonce).
- Byte 38 onward: the ciphertext, followed by the 16-byte GCM tag.
- The first 38 bytes are also fed to GCM as additional authenticated data, so editing the header, for example lowering the iteration count, makes decryption fail.
Why won't my AES ciphertext decrypt?
When raw-key decryption fails, it is almost always one of a few settings that don't match what the other side used.
- Key length: AES needs 16, 24 or 32 bytes. A 32-character text key is 32 bytes, but a 32-character hex key is only 16.
- Encoding: the ciphertext is Base64 and you chose hex, or the reverse.
- Mode: CBC data won't open as CTR, and GCM needs the 16-byte tag at the end.
- IV: CBC and CTR need 16 bytes, and GCM usually uses 12. The IV must be the one used to encrypt.
- Padding: Web Crypto's AES-CBC uses PKCS#7. Data encrypted with zero padding or no padding won't pass the check.
Why use Mavros
| Mavros | Typical upload sites | |
|---|---|---|
| Default mode | AES-256-GCM with an authentication tag | AES-CBC or ECB with no integrity check |
| Password to key | PBKDF2-SHA-256, 600,000 iterations | One MD5 round, or the password used as the key |
| Salt and IV | Random each time, stored in the output | Fixed, or left for you to copy separately |
| Wrong password | Clear error, no garbage output | Garbled text or a silent failure |
| Files | Any type up to 512 MB, saved as .enc | Text only, or a small upload limit |
| Where it runs | Web Crypto in your browser | Often sent to a server |
Tips
- Share the password through a different channel than the encrypted text. Sending both in one email defeats the point.
- Keep a copy of the password. There is no reset, and nobody, including us, can recover the data without it.
- Want proof a decrypted file is identical to the original? Compare both with the SHA-256 hash generator.
- Encryption hides data but doesn't prove who sent it. For signed API messages use the HMAC generator.
Questions
Is AES-256 encryption secure?
Yes. AES-256 is a NIST standard (FIPS 197) with no known practical attack. In practice the weak point is the password, so use a long random one and keep it out of the same message.
What happens if I forget the password?
The data is gone for good. The key comes only from your password, and there is no copy, reset or backdoor. Store the password in a password manager before you delete the original file.
Can I decrypt this with OpenSSL or Python?
Yes, with a few lines of code. Read the iteration count, salt and IV from the header, derive the key with PBKDF2-HMAC-SHA-256, and decrypt with AES-256-GCM using the header as associated data.
What is the difference between AES-GCM and AES-CBC?
GCM encrypts and also authenticates, so tampering or a wrong key is detected. CBC only encrypts and needs padding. Use GCM for new work and CBC only to read existing data.
Is my file uploaded when I encrypt it?
No. The file is read and encrypted in your browser's memory, and the result downloads straight to your device. That is also why files are limited to 512 MB.
How do I decrypt a string that starts with U2FsdGVkX1?
Open the Raw key / OpenSSL tab and choose OpenSSL passphrase. Enter the passphrase, then try PBKDF2 with 10,000 iterations first and MD5 if that fails, since CryptoJS uses MD5.
How many PBKDF2 iterations should I use?
Keep the default of 600,000, which matches OWASP's current advice for PBKDF2-SHA-256. More iterations slow down both you and an attacker. The count is saved in the output, so decryption always uses the right one.