--- title: "AES Encrypt and Decrypt Online - AES-256-GCM | CanDoYa" description: "Encrypt and decrypt text with AES-256-GCM online. Password-based, authenticated, and private in your browser with no upload or sign-up." url: https://candoya.com/tools/aes-encrypt-decrypt/ locale: en type: browser-tool --- # AES Encrypt and Decrypt Online Category: Developer ## What does an AES encrypt and decrypt tool do? An AES encrypt and decrypt tool turns readable text into an authenticated Base64 payload, then restores it with the same password. This page uses AES-256-GCM and a PBKDF2-derived key in your browser. Fresh random values make repeated encryptions different, while GCM rejects changed data instead of returning corrupted text. **The payload is self-contained, but not universal.** It stores a format marker, PBKDF2 work factor, random 16-byte salt, random 12-byte IV, and authenticated ciphertext in one Base64 string. It does not store the password. Other AES tools, OpenSSL, GPG, and password managers use different formats, so they cannot automatically open this custom payload. Encryption and decryption use your browser's Web Crypto API. Your text and password are not sent to CanDoYa. For long-term archives or high-value secrets, use a reviewed encryption product with documented recovery, backups, and key management instead of a convenience tool. ## How to use it 1. **Choose the direction** - Select Encrypt for readable text or Decrypt for a Base64 payload created by this tool. 2. **Add the text and password** - Paste the input and enter a strong, unique password. A longer passphrase resists guessing better than a short password. 3. **Run the operation** - Encrypt or decrypt locally. AES-GCM checks integrity during decryption and rejects a wrong password or changed payload. 4. **Copy and separate** - Copy the result. If you encrypted text, keep the password in a different trusted channel or password manager. ## Who it's for - **Developers** can create private test fixtures or inspect how authenticated browser encryption behaves. - **Students** can see how salts, nonces, password derivation, and authenticated encryption fit together. - **Individuals** can protect a short note before storing it somewhere else, while keeping the password separate. - **Teams** can exchange a small encrypted message after agreeing on this exact payload format and a safe channel for the password. ## Expert note A 256-bit AES key does not make a weak password 256 bits strong: offline attackers can test password guesses against the authenticated payload, so the PBKDF2 work factor only slows guessing and a long unique passphrase remains essential. ## Frequently asked questions ### Is my text or password uploaded? No. The cryptographic operation runs locally through the Web Crypto API in your browser. CanDoYa does not receive the plaintext, encrypted payload, or password. As with any browser tool, use a trusted device and keep browser extensions and the operating system secure. ### Is this AES encryption tool free? Yes. You can encrypt and decrypt text without an account, payment, or software download. The tool has no artificial operation limit, though it intentionally accepts text up to one million characters to keep browser memory and processing time reasonable. ### Can this tool decrypt AES text from another website or OpenSSL? Usually not. AES defines a cipher, not a single portable text format. Tools can differ in mode, key derivation, salt, IV, authentication tag, encoding, and byte layout. This page decrypts only its own CanDoYa v1 Base64 payload format. ### Why does the same text produce a different encrypted result each time? Each encryption creates a fresh random 16-byte salt and 12-byte IV. The salt changes the password-derived key and the IV makes AES-GCM unique for that operation. Different output is expected and prevents repeated messages from revealing an obvious pattern. ### What happens if the password or encrypted text is wrong? AES-GCM authenticates the ciphertext. A wrong password, missing character, or changed byte makes authentication fail, so the tool shows an error instead of returning untrusted plaintext. There is no password reset, recovery key, or backdoor. ### Is AES-256-GCM secure enough for sensitive data? AES-GCM is a modern authenticated encryption mode when used correctly, but the whole system matters. A weak password remains guessable, and a compromised device can expose text before encryption. Use audited software, strong key management, and backups for high-value or long-term secrets. ### Does AES encryption work with emoji and non-English text? Yes. The tool encodes plaintext as UTF-8 before encryption and decodes it as UTF-8 after successful decryption. Accented letters, Cyrillic, Arabic, CJK text, and emoji survive a round trip as long as the payload and password are unchanged. ## Related tools - [PBKDF2 Derive](https://candoya.com/tools/pbkdf2-derive/) - [HMAC Generator](https://candoya.com/tools/hmac-generator/) - [SHA-256 Hash Generator](https://candoya.com/tools/sha-256-hash/) - [Password Generator](https://candoya.com/tools/password-generator/) - [RSA Key Pair Generator](https://candoya.com/tools/rsa-key-pair-generator/) --- *Markdown edition of , published for AI agents and other automated readers. Index of key pages: .*