AES Encryption

AES encryption online

AES is a symmetric block cipher standardized by NIST FIPS 197. The same secret key is needed to encrypt and decrypt data. This tool supports AES-128, AES-192, and AES-256 with text, local file, or URL input.

You can select CBC, CTR, CFB, OFB, ECB, or GCM mode, configure padding where applicable, and use either a direct key or a passphrase-derived key. The recipient must know every required parameter—not just the password—to reproduce the decryption.

How to encrypt with AES

1. Select text, file, or URL input and the appropriate input encoding.
2. Choose the AES key size and mode required by the receiving system.
3. Enter a direct key and IV, or select a passphrase-based key derivation method.
4. Configure padding, salt, iterations, and hash settings when the selected mode or KDF requires them.
5. For GCM, configure the authentication tag and optional additional authenticated data (AAD).
6. Encrypt and save both the ciphertext and all non-secret parameters needed for decryption.

The key or passphrase must remain secret. An IV, nonce, salt, and authentication tag normally do not need to be secret, but they must be generated and stored according to the selected scheme.

Choosing an AES mode

• GCM provides authenticated encryption: it detects modifications when the authentication tag is verified. Never reuse a GCM nonce or IV with the same key.
• CBC requires an appropriate IV and separate authentication when integrity matters.
• CTR, CFB, and OFB turn the block cipher into stream-like operation and require correct IV or counter handling.
• ECB encrypts equal blocks identically and reveals patterns. It is generally unsuitable for structured or multi-block data.

Do not invent a new cryptographic format from individual options unless you understand how its keys, nonces, authentication, and serialization will be managed. Prefer a well-specified interoperable format when one is available.

AES key and passphrase compatibility

A direct AES key must have the exact length required by AES-128, AES-192, or AES-256. A human passphrase is not automatically an AES key; PBKDF2 or EvpKDF derives key material using parameters such as salt, iteration count, and hash function.

Two tools given the same passphrase can still produce different ciphertext when their KDF, salt, IV, mode, padding, or output format differs.

AES encryption FAQ

Why does encryption produce a different result each time?

Secure schemes commonly use a fresh random salt, IV, or nonce. Different ciphertext for the same plaintext can therefore be expected, provided the parameters needed for decryption are retained.

Is Base64 ciphertext encryption?

Base64 and Hex are output encodings for encrypted bytes. They do not add security and can be converted without knowing the AES key.

How do I decrypt the result?

Use the AES Decryption tool with matching key size, mode, key derivation, salt, IV, padding, tag, AAD, and input encoding.