In this article
What Is AES Encryption?
AES (Advanced Encryption Standard) is a symmetric encryption algorithm that uses the same key for both encryption and decryption. AES-256-GCM combines the strongest key size (256 bits) with Galois/Counter Mode, which provides both confidentiality and authentication in a single operation.
This tool lets you encrypt and decrypt text using AES-256-GCM with a password. It is designed for quick, secure message sharing and educational purposes. For production systems, always use established cryptographic libraries and follow your organization's security policies.
How AES-256-GCM Works
The encryption process derives a strong key from your password and produces a portable ciphertext that includes everything needed for decryption.
- PBKDF2 key derivation — your password is stretched into a 256-bit key using PBKDF2 with a random 16-byte salt and 100,000 iterations to resist brute-force attacks
- Random IV generation — a unique 12-byte initialization vector (IV) is generated for each encryption to ensure identical plaintexts produce different ciphertexts
- GCM authentication tag — the ciphertext includes a 128-bit authentication tag that detects any tampering, ensuring both confidentiality and integrity
Try it free — no signup required
Encrypt or Decrypt Text →When To Use AES Encryption
AES encryption is useful whenever you need to protect text data with a shared password.
- Secure message sharing — encrypt a message with a password and share the ciphertext through any channel, sharing the password separately
- Configuration encryption — protect sensitive config values (API keys, connection strings) before storing them in version control or shared drives
- Data at rest protection — encrypt notes, credentials, or other sensitive text before saving to disk or cloud storage
Frequently Asked Questions
What is the difference between AES-256 and AES-128?
AES-128 uses a 128-bit key (2^128 possible keys) while AES-256 uses a 256-bit key (2^256 possible keys). Both are considered secure today, but AES-256 provides a much larger key space and is recommended for long-term data protection and compliance requirements.
Why GCM instead of CBC mode?
GCM (Galois/Counter Mode) provides authenticated encryption — it encrypts data AND verifies integrity in one operation. CBC mode only encrypts and requires a separate MAC for integrity checking. GCM is faster, simpler to implement correctly, and is the recommended mode for modern applications.
Is a password the same as an encryption key?
No. A password is human-readable text that gets converted into a cryptographic key using a key derivation function (PBKDF2 in this tool). The derivation process adds salt and iterations to make the resulting key resistant to dictionary and brute-force attacks, even if the password is relatively short.