Developer Tools
AES Encryption, Decryption & Hashing
Encrypt text with AES-256 (GCM or CBC) protected by a passphrase, decrypt it back, and generate SHA and HMAC hashes. Built on the Web Crypto API — your passphrase and data never leave your browser.
Real cryptography, not a toy cipher
Many “encrypt online” tools use reversible obfuscation that offers no real protection. This one uses the Web Crypto API — the same primitives browsers use for HTTPS — with AES-256, a random salt and IV per message, and PBKDF2 passphrase stretching. AES-GCM also authenticates the ciphertext, so any tampering is detected when you decrypt.
What you can do
- Encrypt & decrypt — AES-256-GCM or AES-256-CBC with a passphrase.
- Portable output — salt, IV and ciphertext packed into one Base64 string.
- Hashing — SHA-1, SHA-256, SHA-384 and SHA-512 fingerprints.
- HMAC — keyed hashes for message authentication.
Frequently asked questions
How strong is the encryption?
It uses the browser-native Web Crypto API with AES-256. Your passphrase is stretched into a key using PBKDF2 with 200,000 iterations of SHA-256 and a random salt, and AES-GCM additionally provides built-in authentication so tampering is detected on decrypt.
What is in the encrypted output?
The Base64 result packs the random salt, the random IV/nonce, and the ciphertext together. That is everything needed to decrypt later with the same passphrase — only the passphrase itself is secret, so it is never stored in the output.
Why can hashes not be reversed?
SHA hashes are one-way functions: they map any input to a fixed-size fingerprint and cannot be turned back into the original. They are for integrity checks and signatures, not for storing recoverable data. Use the encrypt mode when you need to get the text back.
Is anything sent to a server?
No. All key derivation, encryption, decryption and hashing happen locally in your browser. Your passphrase and data never leave your device.