AES Text Encryptor
Encrypt and decrypt text using AES-256-GCM — the same algorithm used by governments, banks, and TLS 1.3. Key derivation uses PBKDF2-SHA256 with 310,000 iterations, hardening against brute-force attacks on the passphrase. Everything runs in your browser's built-in Web Crypto API — no libraries, no server.
1. A random
16-byte salt is generated using crypto.getRandomValues().2. Your passphrase is fed into
PBKDF2(SHA-256, 310000 iterations) with the salt → produces a 256-bit AES key.3. A random
12-byte IV is generated (GCM standard nonce size).4. The plaintext is encrypted with
AES-256-GCM, producing ciphertext + 128-bit authentication tag.5. Output format:
base64(salt || iv || ciphertext || authTag) — all fields needed for decryption are embedded in the output.Security properties:
• GCM mode provides authenticated encryption — any tampering with the ciphertext is detected on decryption.
• PBKDF2 with 310,000 iterations (NIST 2024 recommendation for SHA-256) makes brute-forcing weak passphrases computationally expensive.
• Fresh salt + IV on every encryption ensures identical plaintexts produce different ciphertexts.
• The Web Crypto API implementation is provided by your browser's native crypto engine — not JavaScript.
Frequently Asked Questions
What encryption algorithm is used?
AES-256-GCM with PBKDF2-SHA256 key derivation at 310,000 iterations — the same algorithm family as TLS 1.3, Signal, and WhatsApp.
Is my text or passphrase sent to a server?
No. All encryption and decryption uses the browser's Web Crypto API locally. Your plaintext, passphrase, and ciphertext never leave your device.
What is the salt and IV in the output?
A random salt ensures the same passphrase produces a different key each time. A random IV ensures encrypting the same text twice produces different ciphertext. Both are embedded in the output for decryption.
Can someone decrypt my message without my passphrase?
Not in any practical timeframe. With a strong passphrase and 310,000 PBKDF2 iterations, an attacker is limited to thousands of guesses per second.