Are my password and text sent to your server?

**No**. The entire operation happens in your browser (Web Crypto API in JavaScript). Open **DevTools → Network** while encrypting, you will see zero requests. Our server only serves static HTML/CSS/JS, it never sees your data.

Why a salt and an IV if I already have a password?

[[Salt||random value mixed into the password so the same text encrypted twice yields different ciphertext]] defeats dictionary attacks and rainbow tables. [[IV||initialization vector, a random starting block for each encryption]] defeats "same plaintext, same ciphertext" attacks. We generate both randomly and **pack them into the ciphertext blob**, so you do not have to manage them.

What if I forget the password?

**There is no recovery**. This is not "forgot password on my email account" with a reset link. The key is mathematically derived from the password, without the password **the data is gone forever**. That is what makes encryption strong. Save the password to a password manager (1Password, Bitwarden, KeePassXC) **before you encrypt anything**.

Can I use the same password for many encryptions?

Technically yes, **but not recommended**. For each new secret, generate a new random password. If an attacker ever breaks one of them, all the others fall too. A password manager handles this automatically, it generates a fresh 32-character random password for every use.

What does PBKDF2 with 100,000 iterations mean?

[[PBKDF2||Password-Based Key Derivation Function 2]] is the algorithm that turns your password into a 256-bit key by **repeating the math 100,000 times on purpose**. For you that is ~100 ms, unnoticeable. For an attacker trying to guess your password by checking millions of candidates, it is **100,000 times slower**, so hours become years. OWASP recommends in 2025: PBKDF2 with 600,000 iterations or Argon2id, but 100,000 + AES-GCM is still strong for most use cases.

Is GCM the same as CBC or ECB?

No. **AES is the algorithm**, GCM/CBC/ECB are **modes of operation**. AES-ECB is an **antipattern, never use it** (every block encrypts identically, you can see patterns in the ciphertext). AES-CBC works but needs a separate integrity check (HMAC). **AES-GCM is the modern default**, one algorithm gives you both confidentiality and integrity (auth tag). That is what we use.

Is this as safe as Signal or BitLocker?

Identical algorithm (AES-GCM 256), same key derivation function (PBKDF2 100k iters). Signal also adds [[forward secrecy||each message gets a fresh key, breaking one does not unlock previous messages]] and the X3DH protocol, BitLocker integrates with TPM hardware. **For ad-hoc secret exchange this tool is enough**, but for long-term communication use Signal/WhatsApp, for full disks use BitLocker/LUKS.

Is this as good as a password manager?

1Password and Bitwarden use the same primitives (AES-256 + PBKDF2/Argon2). **The difference:** a manager organizes everything, syncs, autofills, supports emergency recovery. This tool is **plain ad-hoc encryption** for one-off operations. If you have **many secrets**, use a password manager.

Will a quantum computer break AES?

AES-128 drops to **effective 64 bits** under a quantum computer (Grover algorithm), that is still 10^19 but it could be too low in 20 years. **AES-256 drops to 128 bits**, still practically unbreakable. That is why NIST and the NSA recommend **AES-256 for long-term sensitive data** (medical, legal). For everyday secret sharing, 128 is fine for the foreseeable future.

YourDevToolsPro

AES Encrypt / Decrypt

Encrypt text with a password (AES-GCM 256). Runs in your browser, nothing leaves the device.

LiveRuns in your browser

Encrypt text with a password or decrypt an existing ciphertext. AES-GCM 128/256 with PBKDF2. All math runs in your browser.

Key size

Output format

Text to encrypt

Password

Everything runs locally in your browser. Your password and text never leave the device.

What is AES encryption and when to use it?

AES is the most popular cipher in the world. WhatsApp, BitLocker, FileVault, 7zip archives, TLS sessions, all sit on top of AES. Here you encrypt text with a password and get a sealed blob you can send to a friend, store in the cloud, or paste into a database. Without the password, no one reads it.

We use AES-GCM. The encryption key is derived from your password using PBKDF2 with 100,000 iterations.

Everything runs in your browser. Password, plaintext, ciphertext, not a single byte leaves your device. Open DevTools and check the Network tab, zero requests.

How to use

Pick the mode at the top: Encrypt (text into ciphertext) or Decrypt (ciphertext back into text).
Paste or type your text into the middle field. Could be anything, an API key, a note, a Wi-Fi password.
Enter a password. This must be your password, known only to you. If you forget it, no one can recover the data.
Optionally pick AES-128 or AES-256 (both safe, 256 is a fraction slower) and the output format: base64 (compact) or hex (more readable for developers).
Click the button, copy the result. Send the recipient ciphertext + password on separate channels (email + SMS).

When to use it

Six common situations where AES encryption solves the problem:

Sending a password to a friend. Encrypt the password, email the ciphertext, text the password over SMS. Much safer than plain email.
Backing up a sensitive note to the cloud. Password list, 2FA backup codes, medical info, banking details. Encrypt before uploading to Dropbox, Drive, OneDrive.
API key in a repository. Stripe secret or DB password, paste it encrypted into README, decrypt locally.
Sending a text file over an untrusted channel. SSH private key, a CV with personal info, internal company docs.
Encrypting column data in a database. GDPR compliance, this is a demo of the concept.
Sharing a secret between two people. Hotel Wi-Fi password, a door code, the combination to a safe.

To generate a strong password for encryption, use the password generator. If you need to exchange a public key instead of a password, see the PGP keypair generator.

Questions and answers

Both are safe. AES-128 has a 128-bit key (~10^38 possibilities), AES-256 has 256 bits (~10^77). No computer on Earth will brute-force 128 bits, but 256 gives a wider margin for the future (quantum computers). NIST recommends 256 for US government "Top Secret" data. For regular users the difference is negligible, pick 256 for peace of mind.

Related tools

Full name

Generate an OpenPGP keypair (Ed25519 or RSA) right in your browser. Armored ASCII format, ready to import.

Password Generator

Create strong, cryptographically random passwords - entirely in your browser.

Password Hashes: MD5, SHA, bcrypt

16 hash algorithms: MD4, MD5, SHA, SHA-3, RIPEMD, MySQL, NTLM, HMAC, bcrypt - with optional salt.

JWT Signer / Verifier

Sign a JWT with a secret or private key. Verify an existing token. HS/RS/ES/PS 256/384/512.

Base/Hex/Base32/64 Converter

Convert between text, hex, base32, base58, base64, base64url, binary and decimal. Both directions, live.

AES Encrypt / Decrypt

Encrypt text with a password (AES-GCM 256). Runs in your browser, nothing leaves the device.

LiveRuns in your browser

AES Encrypt / Decrypt

Encrypt text with a password or decrypt an existing ciphertext. AES-GCM 128/256 with PBKDF2. All math runs in your browser.

Key size

Output format

Text to encrypt

Password

Everything runs locally in your browser. Your password and text never leave the device.

What is AES encryption and when to use it?

We use AES-GCM. The encryption key is derived from your password using PBKDF2 with 100,000 iterations.

Everything runs in your browser. Password, plaintext, ciphertext, not a single byte leaves your device. Open DevTools and check the Network tab, zero requests.

How to use

Pick the mode at the top: Encrypt (text into ciphertext) or Decrypt (ciphertext back into text).
Paste or type your text into the middle field. Could be anything, an API key, a note, a Wi-Fi password.
Enter a password. This must be your password, known only to you. If you forget it, no one can recover the data.
Optionally pick AES-128 or AES-256 (both safe, 256 is a fraction slower) and the output format: base64 (compact) or hex (more readable for developers).
Click the button, copy the result. Send the recipient ciphertext + password on separate channels (email + SMS).

When to use it

Six common situations where AES encryption solves the problem:

Sending a password to a friend. Encrypt the password, email the ciphertext, text the password over SMS. Much safer than plain email.
Backing up a sensitive note to the cloud. Password list, 2FA backup codes, medical info, banking details. Encrypt before uploading to Dropbox, Drive, OneDrive.
API key in a repository. Stripe secret or DB password, paste it encrypted into README, decrypt locally.
Sending a text file over an untrusted channel. SSH private key, a CV with personal info, internal company docs.
Encrypting column data in a database. GDPR compliance, this is a demo of the concept.
Sharing a secret between two people. Hotel Wi-Fi password, a door code, the combination to a safe.

To generate a strong password for encryption, use the password generator. If you need to exchange a public key instead of a password, see the PGP keypair generator.