AES Encrypt / Decrypt

Password-derived key (PBKDF2) + AES-256-GCM encryption with Base64 output; fully reversible.

What this tool does

Encrypts any text with a password into a Base64 ciphertext; anyone with the ciphertext and password can decrypt it with the same tool. Under the hood: the password is stretched into a 256-bit key via PBKDF2 (SHA-256, 100,000 iterations), then AES-256-GCM does the encryption, with a fresh random salt and IV every time — encrypting the same text twice produces completely different ciphertexts. The output format is Base64(16-byte salt + 12-byte IV + ciphertext). Everything runs locally; passwords and plaintext are never uploaded.

Typical use cases

Sending sensitive snippets (server addresses, temporary credentials) through a chat message while sharing the password over a separate channel; encrypting a note or config fragment before storing it in a cloud notes app; learning and verifying the full symmetric-encryption pipeline — key derivation, IVs, authenticated encryption. Far lighter than zipping with a password.

Caveats

AES-256 itself is unbreakable, but the real strength of this scheme is the password — “123456” defeats any algorithm, so use a long one. GCM is authenticated encryption: a failed decrypt means a wrong password or tampered ciphertext, never garbled plaintext. This tool is for ad-hoc point-to-point encryption; it is not a replacement for end-to-end encrypted messaging, and derivation logic should not be hard-coded into production systems — use proper key management there.