AES Text Encrypter / Decrypter

How it works

Enter your text and a password, and the tool derives a 256-bit AES key from the password using PBKDF2 (150,000 iterations of SHA-256). It then encrypts the text with AES-GCM, which provides both confidentiality and tamper detection. A random salt and initialization vector are generated for every message and packed into the output, so encrypting the same text twice produces different results.

To decrypt, paste the Base64 output and enter the same password. If the password is wrong or the text was altered, decryption fails safely.

Use cases

• Send a password, note or API key over email or chat without exposing it in plain text
• Store sensitive snippets in a document while keeping them unreadable
• Learn how authenticated symmetric encryption works in practice

Security notes

Everything runs in your browser via the Web Crypto API — no text or password is ever uploaded. Share the encrypted text and the password through separate channels, and choose a strong password, since the security of the message depends entirely on it.

Key features at a glance

• Encrypts text with AES-256-GCM, an authenticated cipher
• Derives the key from your password using PBKDF2 (150,000 SHA-256 iterations)
• Generates a fresh random salt and IV for every message
• Bundles everything into a single Base64 string you can share anywhere
• Decrypts with the same password; fails safely if it is wrong or the text was altered
• Runs entirely in the browser via the Web Crypto API — nothing is uploaded

Why AES-GCM and PBKDF2 matter

AES-256 is the symmetric cipher trusted by governments and industry to protect classified and financial data. The GCM mode used here adds authentication: it not only hides the contents but also detects any tampering, so if even one byte of the ciphertext is changed, decryption fails rather than returning corrupted or forged plaintext. This combination of confidentiality and integrity is what makes AES-GCM a modern default for encrypting messages.

A password by itself is not a good encryption key, so the tool runs it through PBKDF2 — a key derivation function that applies SHA-256 150,000 times with a random salt. The iterations make each guess expensive, slowing brute-force attacks against weak passwords, and the per-message salt ensures the same password produces a different key each time. Together these defenses mean the strength of your encrypted message rests squarely on the strength of the password you choose.

How salt and IV keep messages safe

Each time you encrypt, the tool generates a random salt and a random initialization vector (IV). The salt personalizes the key derivation so identical passwords never yield identical keys, defeating precomputed lookup attacks. The IV randomizes the encryption itself, which is why encrypting the same text twice with the same password produces two completely different outputs — an important property that prevents attackers from spotting repeated messages.

Both the salt and IV are not secret; they are packed into the Base64 output alongside the ciphertext and authentication tag so the recipient's decryption can reconstruct the key and verify integrity. This self-contained bundle is what lets you paste a single string into an email or chat and have the other side decrypt it with nothing more than the shared password.

Tips for secure sharing

• Choose a long, strong password — the message is only as safe as it is
• Send the encrypted text and the password through separate channels
• Never email both the ciphertext and password in the same message
• Generate the password with our passphrase generator for memorability and strength
• Remember a wrong password or altered text causes decryption to fail safely

Why choose our AES encrypter / decrypter?

Our tool is completely free with no signup, no limits, and no subscription. Everything runs in your browser via the Web Crypto API — no text or password is ever uploaded — so you can encrypt genuinely sensitive content with confidence, even offline.

It is one of more than 200 free tools on ToopTools, and you can pin it to your My Workspace, a personalized workspace where you keep the tools you use most in a single dashboard. Beside the passphrase generator and token tools, it gives you a self-contained way to protect and share secrets without leaving your workspace.

Common use cases

People use the encrypter to send a password, private note, or API key over email or chat without exposing it in plain text, sharing the password separately so neither channel reveals the secret alone. It is also useful for storing sensitive snippets inside an otherwise ordinary document while keeping them unreadable to anyone without the password.

Developers and students use it to learn how authenticated symmetric encryption works in practice, observing how the same input produces different ciphertext each time and how tampering is detected. Because the output is a portable Base64 string, the encrypted message can travel through any text-based channel and be decrypted later on any device.

Is the AES encrypter free to use?

Yes. It is completely free with no account, no sign-up, and no usage limits. Encrypt and decrypt as much text as you like at no cost.

What happens if I forget the password?

There is no recovery. The encryption is designed so the message can only be decrypted with the correct password, and nothing is stored on a server. If the password is lost, the encrypted text cannot be recovered.

Is AES-256-GCM encryption secure?

Yes. AES-256-GCM is a modern, authenticated cipher trusted for protecting sensitive data. With a strong password it provides both confidentiality and tamper detection, making it a sound choice for sharing secrets.

Can I send the encrypted text over email or chat?

Yes. The output is a plain Base64 string safe to paste into any text channel. Just be sure to send the password through a different channel so a single intercepted message does not reveal both.

Why does encrypting the same text twice give different results?

Because a fresh random salt and IV are generated for each message. This is a security feature: it prevents anyone from telling that two outputs encrypt the same content, and it does not affect decryption, which reads the salt and IV from the output.

Is my text or password uploaded anywhere?

No. All encryption and decryption happen locally in your browser using the Web Crypto API. Neither your text nor your password is ever transmitted, so the tool is private and works offline.

How do I encrypt text with a password?

Type or paste your text, enter a password, and click Encrypt — the tool produces an AES-256-GCM encrypted string you can copy and share. To read it, paste it back with the same password and click Decrypt. Without the password the text cannot be recovered.

Does the AES encrypter work offline?

Yes. Encryption and decryption run entirely in your browser, so once the page has loaded the tool works without an internet connection, and neither your text nor your password is ever uploaded — they never leave your device.