AES Text Encryptor / Decryptor

Most password managers and secure-note apps encrypt locally before syncing, but sometimes you just need to turn a raw text string into something unreadable, share the output over an insecure channel, and let the recipient reverse it with nothing but a passphrase. That is what this tool does: no account, no server, no upload.

Type or paste any text, set a passphrase, and click Encrypt. The output is a self-contained Base64 string that embeds the random salt and IV used for that specific encryption, so decryption needs only the ciphertext and the passphrase, with no side channel for the parameters.

Getting Your First Text Encrypted

1. Click Sample to load a realistic API key block into the input, or paste your own text.
2. Type a passphrase into the Passphrase field, or click Random to generate a 20-character one. The strength bar turns green at 16 characters.
3. Click Encrypt. A 280+ character Base64 string appears in the output panel.
4. Click Send to Decrypt panel to verify round-trip to confirm the output decrypts back to the original before you rely on it.
5. To decrypt later: switch to the Decrypt tab, paste the Base64 string, enter the same passphrase, and click Decrypt.

Algorithm and Wire Format

• PBKDF2 (250,000 rounds of SHA-256) stretches the passphrase into a 256-bit key. 250,000 rounds adds roughly 0.3 s of computation on modern hardware, making brute-force expensive for an attacker who only has the ciphertext.
• AES-256-GCM is the symmetric cipher. GCM mode authenticates the ciphertext: any modification to the Base64 output causes decryption to fail rather than silently returning garbled text.
• Random salt and IV per encryption. The same plaintext and passphrase produce a different Base64 string every time. This prevents frequency analysis across a collection of ciphertexts produced by the same key.
• Self-contained output. The 32-byte header embeds the 4-byte marker ATXT, the 16-byte PBKDF2 salt, and the 12-byte GCM IV before the ciphertext, so no side channel is needed to pass these values to the decryptor.

Worked Example: Encrypting an API Key

Click Sample to load: Service: Northwind Payments API / Key: npk_live_4Xr8mKqZ2wJsLv9YbTcDnF1eUoHgPi0A / Environment: production / Rotate every 90 days. Enter any passphrase and click Encrypt. A 280+ character Base64 string appears. Switch to Decrypt, paste it, use the same passphrase, and the original credential block comes back verbatim. Change even one character of the ciphertext and you will see: “Decryption failed — wrong passphrase, or the ciphertext has been modified.”

When Not to Use This Tool

• For files, use the AES File Encryptor on this platform. It handles binary input and sizes up to 100 MB.
• For sending a secret to someone who does not already know the passphrase, you need asymmetric encryption (RSA or ECDH key exchange). Both key generators are on this platform. This tool requires a pre-shared secret.
• The maximum input is 50,000 characters. An error names the exact character count when exceeded.
• Nothing is stored or uploaded. Closing the tab discards all state. Keep a copy of the passphrase separately; there is no recovery path if it is lost.