CanDoYa
All tools
Saved toolsYour favorites

Add to favorites

Saved in this browser only.
Private browser utility / Developer

AES Encrypt and Decrypt Online

Runs entirely in your browser - no upload, no sign-up.

Live workspaceLocal processing
AES-256-GCMAuthenticated encryption with a password-derived key

Use at least 8 characters. A long, unique passphrase is much harder to guess.

Press Ctrl+Enter or Cmd+Enter to run.

Local result

Encrypted Base64 payload

Ready to seal your text

Enter text and a strong password. The output will bundle everything needed for decryption except the password.

Share this tool
aes encrypt decrypt / browser utility
01 / Overview

What does an AES encrypt and decrypt tool do?

An AES encrypt and decrypt tool turns readable text into an authenticated Base64 payload, then restores it with the same password. This page uses AES-256-GCM and a PBKDF2-derived key in your browser. Fresh random values make repeated encryptions different, while GCM rejects changed data instead of returning corrupted text.

02

How to use

  1. 01
    Choose the direction

    Select Encrypt for readable text or Decrypt for a Base64 payload created by this tool.

  2. 02
    Add the text and password

    Paste the input and enter a strong, unique password. A longer passphrase resists guessing better than a short password.

  3. 03
    Run the operation

    Encrypt or decrypt locally. AES-GCM checks integrity during decryption and rejects a wrong password or changed payload.

  4. 04
    Copy and separate

    Copy the result. If you encrypted text, keep the password in a different trusted channel or password manager.

03

Who it's for

  • Developers can create private test fixtures or inspect how authenticated browser encryption behaves.
  • Students can see how salts, nonces, password derivation, and authenticated encryption fit together.
  • Individuals can protect a short note before storing it somewhere else, while keeping the password separate.
  • Teams can exchange a small encrypted message after agreeing on this exact payload format and a safe channel for the password.

The payload is self-contained, but not universal. It stores a format marker, PBKDF2 work factor, random 16-byte salt, random 12-byte IV, and authenticated ciphertext in one Base64 string. It does not store the password. Other AES tools, OpenSSL, GPG, and password managers use different formats, so they cannot automatically open this custom payload.

Encryption and decryption use your browser's Web Crypto API. Your text and password are not sent to CanDoYa. For long-term archives or high-value secrets, use a reviewed encryption product with documented recovery, backups, and key management instead of a convenience tool.

FAQ

Is my text or password uploaded?

No. The cryptographic operation runs locally through the Web Crypto API in your browser. CanDoYa does not receive the plaintext, encrypted payload, or password. As with any browser tool, use a trusted device and keep browser extensions and the operating system secure.

Is this AES encryption tool free?

Yes. You can encrypt and decrypt text without an account, payment, or software download. The tool has no artificial operation limit, though it intentionally accepts text up to one million characters to keep browser memory and processing time reasonable.

Can this tool decrypt AES text from another website or OpenSSL?

Usually not. AES defines a cipher, not a single portable text format. Tools can differ in mode, key derivation, salt, IV, authentication tag, encoding, and byte layout. This page decrypts only its own CanDoYa v1 Base64 payload format.

Why does the same text produce a different encrypted result each time?

Each encryption creates a fresh random 16-byte salt and 12-byte IV. The salt changes the password-derived key and the IV makes AES-GCM unique for that operation. Different output is expected and prevents repeated messages from revealing an obvious pattern.

What happens if the password or encrypted text is wrong?

AES-GCM authenticates the ciphertext. A wrong password, missing character, or changed byte makes authentication fail, so the tool shows an error instead of returning untrusted plaintext. There is no password reset, recovery key, or backdoor.

Is AES-256-GCM secure enough for sensitive data?

AES-GCM is a modern authenticated encryption mode when used correctly, but the whole system matters. A weak password remains guessable, and a compromised device can expose text before encryption. Use audited software, strong key management, and backups for high-value or long-term secrets.

Does AES encryption work with emoji and non-English text?

Yes. The tool encodes plaintext as UTF-8 before encryption and decodes it as UTF-8 after successful decryption. Accented letters, Cyrillic, Arabic, CJK text, and emoji survive a round trip as long as the payload and password are unchanged.