What encryption algorithm does this tool use?

This tool uses AES-256-GCM (Advanced Encryption Standard with 256-bit keys in Galois/Counter Mode). AES-256 is used by governments, financial institutions, and militaries worldwide. GCM mode provides authenticated encryption, meaning any tampering with the ciphertext is detected during decryption.

How is the encryption key derived from my password?

Your password is not used directly as the encryption key. Instead, PBKDF2 (Password-Based Key Derivation Function 2) with 100,000 iterations of HMAC-SHA-256 and a cryptographically random 16-byte salt is used to derive a 256-bit AES key. This makes brute-force attacks against weak passwords significantly slower.

Is my text sent to a server?

No. All encryption and decryption operations run entirely in your browser using the W3C Web Crypto API (window.crypto.subtle). Your plaintext, password, and ciphertext never leave your device. GoodParse has no backend server involved in this process.

What is the output format of the encrypted text?

The output is a Base64-encoded string containing the 16-byte random salt, the 12-byte random IV (Initialization Vector), and the AES-GCM ciphertext concatenated together. This self-contained format means you only need the password to decrypt — no separate salt or IV management required.

What happens if I use the wrong password to decrypt?

AES-GCM's authentication tag will fail verification and decryption will be rejected. You will see an error message rather than silently incorrect output. This is one of the key advantages of authenticated encryption — it detects both wrong passwords and data corruption.

What is the difference between AES-256-GCM and AES-256-CBC?

AES-256-GCM is authenticated encryption — it simultaneously encrypts and authenticates the data, providing both confidentiality and integrity. AES-256-CBC only encrypts and requires a separate HMAC for integrity. GCM is the modern recommended mode and is faster on hardware that supports AES-NI acceleration.

ToolsAES Encryption / Decryption

AES Encryption / Decryption

Encrypt and decrypt text with AES-256-GCM using a password. PBKDF2 key derivation, fully client-side via the Web Crypto API.

Password (secret key)

Plain TextEmpty

Encrypted (Base64)Waiting

How to use AES Encryption / Decryption?

1
Choose Encrypt or Decrypt mode.
2
Enter your text and a secret password (used to derive the AES key).
3
Click Encrypt to produce a base64 cipher, or Decrypt to recover the original text.
4
Use the same password to decrypt that you used to encrypt — there is no recovery if it is lost.

Frequently Asked Questions

What encryption does this use?

AES-256 in GCM mode, an authenticated encryption standard. The key is derived from your password using PBKDF2 with 100,000 iterations of SHA-256 and a random salt.

Is my data sent to a server?

No. All encryption and decryption run entirely in your browser via the Web Crypto API. Your text and password never leave your device.

What happens if I forget the password?

The data cannot be recovered. AES-GCM with a strong password is designed so that decryption is impossible without the exact password. Store it safely.

Encrypt and Decrypt Text with AES-256

Quick Answer: This tool encrypts text with AES-256-GCM, deriving a key from your password via PBKDF2. The salt and IV are bundled into the output so you only need the password to decrypt.

AES (Advanced Encryption Standard) is the symmetric cipher trusted by governments and industry worldwide. Symmetric means the same password encrypts and decrypts the data. GCM mode adds authentication, so any tampering with the ciphertext is detected during decryption.

How This Tool Protects Your Data

PBKDF2 key derivation: Your password is stretched with 100,000 iterations, making brute-force attacks expensive.
Random salt & IV: Every encryption uses fresh random values, so encrypting the same text twice yields different output.
Client-side only: Nothing is uploaded. The operation runs in your browser's secure crypto engine.