Click Encrypt or Decrypt after editing. AES-GCM encryption generates a fresh nonce every time and exports JSON containing the nonce, associated data and Base64 ciphertext. Keep your key separately. To decrypt, paste the complete JSON export, or use raw Base64/hex ciphertext with its original nonce and associated data.
The same thing on the command line
# Encrypt (asks for the password)
openssl enc -aes-256-cbc -pbkdf2 -a -in message.txt -out message.enc
# Decrypt
openssl enc -d -aes-256-cbc -pbkdf2 -a -in message.enc
# Output always starts with U2FsdGVkX1, which is Base64 for "Salted__"import os
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
key = AESGCM.generate_key(bit_length=256)
nonce = os.urandom(12) # never reuse with the same key
ct = AESGCM(key).encrypt(nonce, b"secret", b"header") # ciphertext + 16-byte tag
AESGCM(key).decrypt(nonce, ct, b"header")const key = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
const iv = crypto.getRandomValues(new Uint8Array(12));
const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, new TextEncoder().encode('secret'));Need a random key? The secret key generator makes 128- and 256-bit keys in hex or Base64. Checking a file’s integrity rather than hiding it? Use the hash generator.
Frequently asked questions
Can I decrypt the output with OpenSSL?
Yes. In password mode the output uses the exact format of openssl enc with -pbkdf2: “Salted__”, an 8-byte random salt and the AES-CBC ciphertext, Base64-encoded with lines of 64 characters. Save it to a file and run openssl enc -d -aes-256-cbc -pbkdf2 -a -in file.txt. It works the other way too: paste the output of openssl enc -aes-256-cbc -pbkdf2 -a and decrypt it here. The command for the current settings is shown under the tool.
Why does it say “wrong password” for my OpenSSL file?
Either the password is different, or the settings don’t match: the key size (-aes-128-cbc vs -aes-256-cbc), the iteration count (-iter, 10,000 by default with -pbkdf2), or the file was made without -pbkdf2. Without it, OpenSSL uses its old key derivation (EVP_BytesToKey), which is weak and not supported here; OpenSSL itself warns about it (“deprecated key derivation used”).
What’s the difference between the two modes?
Password mode turns a password into a key with PBKDF2 and encrypts with AES-CBC, compatible with OpenSSL; it’s good for sharing a file with someone who has the password. AES-GCM mode uses a raw 128-, 192- or 256-bit key and a 96-bit IV, as application code usually does, and adds an authentication tag, so any change to the ciphertext is detected instead of producing garbage.
Is AES-CBC secure?
CBC keeps data confidential, but it doesn’t detect tampering: someone can change ciphertext bytes and you won’t notice until the decrypted text looks wrong (or worse, a system acts on it). For data in your own applications, use an authenticated mode such as AES-GCM, as in the second mode here, or a library like libsodium that picks safe defaults.
Is my text or password sent anywhere?
No. Encryption uses your browser’s built-in Web Crypto API; the text, password and keys never leave the page and aren’t included in share links. Even so, for highly sensitive data prefer tools you run locally, such as the openssl command.