AES Encryption Online

How to use

1. 1.Choose Encrypt, enter the plaintext and a unique password of at least 12 UTF-8 bytes, then run AES-256-GCM encryption.
2. 2.Copy and preserve the complete JSON package while keeping the password in a separate secure channel.
3. 3.Choose Decrypt, paste the unchanged package, enter the same password, and run decryption; authentication failure is reported without partial plaintext.

About AES Encryption Online

AES Encryption Online encrypts text into a self-contained JSON package and decrypts that package with the same password. Both operations run through the browser Web Crypto API. The plaintext, password, derived key, and decrypted result stay in the current page and are not submitted to Lizely. The output can be copied as text for controlled transfer or storage, but the password must be communicated and protected separately.

Encryption uses AES with a 256-bit key in Galois/Counter Mode. AES-GCM provides confidentiality and an authentication tag, so decryption rejects a package when the password is wrong or the protected bytes were modified. The tool requests a fresh 16-byte random salt and a fresh 12-byte random initialization vector for every encryption. Repeating the same plaintext and password should therefore produce a different package instead of revealing equality through deterministic ciphertext.

The password is converted to UTF-8 and processed with PBKDF2 using SHA-256 and 210,000 iterations to derive the AES key. The random salt is not secret and is stored in the package. PBKDF2 raises the cost of password guessing, but it cannot turn a short, reused, leaked, or predictable password into a strong secret. The interface requires at least 12 UTF-8 bytes and allows longer passphrases. Use a unique high-entropy passphrase from a trusted password manager for meaningful protection.

The JSON package declares version 1, AES-256-GCM, PBKDF2-SHA-256, and the iteration count. It also carries base64url fields for the salt, initialization vector, and authenticated ciphertext, which includes the 128-bit GCM tag returned by Web Crypto. Decryption validates those labels, numeric limits, field syntax, exact salt and IV lengths, and minimum ciphertext length before asking Web Crypto to authenticate and decrypt the content.

This format is specific to this tool. Its cryptographic ingredients are standardized, but the surrounding JSON field layout is not a universal file format. Another system can interoperate only if it reproduces the same UTF-8 handling, PBKDF2 parameters, AES-GCM tag placement, base64url encoding, and JSON fields. Keep the whole package unchanged. Removing a field, normalizing its text incorrectly, or inserting conventional padded Base64 where base64url is expected will make validation fail.

AES-GCM requires an initialization vector that is unique for a given key. The tool generates a new random value rather than asking users to invent one. Never edit the package to reuse an old IV, salt, or ciphertext. The random values are stored openly because their purpose is uniqueness and key derivation, not secrecy. The password is never written into the output, and there is no password recovery, escrow, account backup, or server-side key management.

Use this page for small text snippets, demonstrations, controlled exchanges, and compatibility experiments. It is not a managed vault, enterprise key management service, encrypted backup system, or substitute for reviewed application-level cryptographic design. Browser extensions, compromised devices, clipboard managers, screen capture, shared computers, and copied package destinations remain outside the cryptographic boundary. Clear sensitive content and close the tab when the surrounding device is not trusted.

The implementation is checked against NIST AES-GCM vectors, including an empty plaintext authentication case and a full zero-block encryption case. Base64url fixtures follow RFC 4648, while AES-GCM, PBKDF2, key import, derivation, encryption, and decryption use the Web Cryptography specification. These checks prove defined transformations and package invariants; they do not certify the browser, device, password choice, storage location, or broader workflow.

Methodology & sources

Web Crypto derives a non-exportable 256-bit AES key with PBKDF2-SHA-256, a 16-byte salt, and 210,000 iterations, then encrypts with AES-GCM using a fresh 12-byte IV and 128-bit tag. The versioned JSON package uses unpadded base64url.

• NIST SP 800-38D
• W3C Web Cryptography Level 2
• RFC 4648

Frequently asked questions

Related tools

• 🔐Password Generator
  Generate strong random passwords locally with a cryptographically secure RNG — nothing is ever uploaded.
• 🔣Base64 Encode / Decode
  Encode or decode Base64 instantly with full UTF-8 support — emoji and accents work, all in your browser.
• UTF-8 Encoder / Decoder
  Convert Unicode text to well-formed UTF-8 bytes or strictly decode byte sequences without silent replacement.
• Text To HEX
  Encode text into exact UTF-8 hexadecimal with continuous, spaced, or 0x-prefixed output and explicit Unicode replacement warnings.
• ASCII Converter
  Convert standard 7-bit ASCII text to decimal codes or decode decimal codes back to exact ASCII characters locally.
• Base100 Encoder / Decoder
  Encode UTF-8 text as the original Base100 emoji mapping or strictly decode Base100 symbols back to valid UTF-8 text.

• Decode a Caesar Cipher Without Guessing the Shift
• How to Generate a Secure Password Using Google and Local Tools
• How Do I Translate Morse Code | Tools and Methods
• How Does Binary to Text Work: A Plain-English Guide
• How to Base64 Decode Text Instantly (Step-by-Step Guide)