Runs in your browser · nothing uploaded

AES Encryption Tool — Explicit Key, IV & Mode (GCM/CBC)

Encrypt or decrypt with your own AES-128/256 key and IV in GCM or CBC mode. A raw, explicit bench for learning and development — runs entirely in your browser.

Loading tool…

More tools

All free, all private — everything runs in your browser.

Keys

RSA Keypair Generator

Generate an RSA-OAEP keypair in your browser and export the public and private keys as PEM files. 2048, 3072, or 4096 bits. No upload, no server, free.

Keys

PBKDF2 Key Deriver

Derive a cryptographic key from a password with PBKDF2-HMAC-SHA256. Tunable iterations, random or custom salt, hex or base64 output. Runs in your browser.

Files

File Encryptor

Password-protect any file before you email or share it. AES-256-GCM with a PBKDF2-derived key, performed locally by your browser — no upload, no signup. Free.

FilesPro

Bulk File Encryptor

Batch-encrypt many files with a single password into one downloadable .sealbox archive, and restore them all at once. AES-256-GCM per file, performed locally — no upload. SealBox Pro.

Text

Text Encryptor

Turn any message into a shareable encrypted string and back. AES-256-GCM with PBKDF2 key derivation, performed locally by your browser. No upload, free.

TextPro

Encrypted Notes Vault

Keep private notes encrypted with a master password, stored only on your device. The master password derives an AES-256-GCM key and is never stored. 100% client-side. SealBox Pro.

How to use AES Encryption Tool

  1. 1Choose the cipher: AES-128 or AES-256, in GCM (authenticated) or CBC (legacy) mode.
  2. 2Provide the raw key (16 or 32 bytes) and the IV (12 bytes for GCM, 16 for CBC) as hex or base64.
  3. 3Enter the plaintext to encrypt, or the base64/hex ciphertext to decrypt.
  4. 4Copy the output — base64 or hex — and remember the exact key and IV you used, or decryption is impossible.

AES Encryption Tool FAQ

What is the difference between GCM and CBC?
GCM is authenticated encryption: it produces a tag that is verified on decryption, so tampering is detected and rejected. CBC provides confidentiality only — an attacker can modify the ciphertext undetected. Prefer GCM for anything real; CBC is here for learning and interoperability with legacy systems.
How long are the key and IV?
AES-128 needs a 16-byte key, AES-256 a 32-byte key. GCM uses a 12-byte IV; CBC uses a 16-byte IV. Enter them as hex or base64 — the tool tells you when the length is wrong. Never reuse the same IV with the same key in GCM.
Is this suitable for protecting real data?
For everyday protection use the File Encryptor or Text Encryptor, which derive a strong key from your password with PBKDF2 and generate a fresh random IV for you. This raw bench assumes you already have a key — a reused or weak key is your responsibility.