AES Encryption Tool
Online AES encryption and decryption tool supporting AES-128, AES-192 and AES-256 across ECB, CBC, CTR and GCM modes, with PKCS7/PKCS5 or no padding and Base64 or Hex input and output.
FreeOnline Tool
Loading…
How to Use
- Enter plaintext to encrypt, or ciphertext to decrypt.
- Enter the key (16 bytes for AES-128, 32 bytes for AES-256).
- Choose the mode (CBC recommended) and the padding scheme.
- CBC mode also requires a 16-byte initialisation vector (IV).
- Click Encrypt or Decrypt to get the result.
Features
- Supports AES-128, AES-192 and AES-256 key lengths
- Supports ECB, CBC, CTR and GCM modes
- Supports PKCS7/PKCS5 padding as well as NoPadding
- Accepts and produces both Base64 and Hex
- Computed locally, so keys and data are never uploaded
Use Cases
Encrypting local files
Encrypt sensitive document content with AES-256-CBC before storing it, so a leaked file is unreadable without the key.
Encrypting data in transit
Agree on an AES key and mode between client and server to encrypt sensitive fields and guard against interception.
Encrypting database fields
Store sensitive columns such as phone numbers and ID numbers as AES ciphertext to meet data protection requirements.
Debugging encryption interoperability
Check quickly whether AES parameters match across languages and frameworks when encryption works on one platform but not another.
FAQ
Is AES-128 or AES-256 more secure?
AES-256 uses a longer key and therefore offers a higher security margin, but AES-128 is also considered secure against current computing power. The difference lies in key length rather than any weakness in the algorithm itself.
Should I use CBC or GCM mode?
GCM provides authentication alongside encryption (AEAD), so it can detect tampered ciphertext, making it the more modern choice. CBC only encrypts and needs a separate MAC for integrity. Prefer GCM for new projects.
Does the IV need to be secret?
No. The IV is not secret and is normally transmitted with the ciphertext, often prefixed to it. What matters is that a fresh random IV is used for every encryption and never reused.
What happens if the key length is wrong?
AES-128 needs a 16-byte key and AES-256 needs 32 bytes. A short key is typically zero-padded or rejected, and an over-long one is truncated. Generate keys with a cryptographic random number generator rather than using a plain string.