AES Text Encryptor — Password-Based AES-256-GCM in Your Browser

Real-world use cases

• Send a one-off secret without setting up PGP

  You need to send a colleague a database connection string or a recovery code, but standing up PGP keys for a single message is overkill. Workflow: paste the secret, type a passphrase you can tell them out-of-band (over a phone call, not the same email), hit Encrypt, copy the Base64 blob into the email. They paste it here, type the same passphrase, hit Decrypt. The secret never travels in cleartext through your mail provider's servers, and there is no key infrastructure to manage afterward.

• Stash an API key in a notes app you do not fully trust

  You keep working notes in a cloud notes app that syncs everywhere, and you want a Stripe or OpenAI key handy without it sitting in plaintext on someone else's server. Encrypt the key with a strong passphrase, paste only the ciphertext into the note. When you need the key, open this tool, paste the blob, decrypt. Even if the notes provider is breached, the attacker gets an AES-256 blob, not your key.

• Add a tamper-evident integrity check to transmitted text

  You are pasting a config snippet into a ticket and want the recipient to know it arrived unmodified. Because AES-GCM is authenticated, encrypting the snippet means any later edit — even a single character — makes decryption fail outright rather than silently producing a wrong-but-plausible result. The recipient decrypting successfully is proof the bytes are exactly what you sent.

• Teach or demo authenticated encryption hands-on

  Explaining why "encryption without authentication is dangerous" lands better with a live demo. Encrypt a message, copy the Base64, then flip one character of the ciphertext and try to decrypt — it fails with an auth error instead of returning corrupted text. Then show that Base64 alone hides nothing by decoding it elsewhere. Two minutes of pasting beats a slide on GCM tags.

• Protect clipboard text on a shared or kiosk machine

  On a shared workstation you sometimes need to carry a short secret between two sessions without leaving it readable in a paste buffer or a temp file. Encrypt it here first, move only the ciphertext, and decrypt on the other side. If someone inspects the clipboard history or a synced paste manager, they see an opaque blob, not the secret.

Common pitfalls

• Using a weak, short password. PBKDF2 at 250,000 iterations slows offline brute force but does not make a 6-character password safe — once an attacker has your ciphertext they can grind guesses on their own hardware. Use a long random passphrase, especially for anything valuable.

• Pasting only part of the ciphertext. The payload bundles the salt and IV with the ciphertext, so dropping characters (or losing trailing Base64 padding when copying) makes it undecodable. Copy the whole string, every character, including any trailing `=`.

• Treating Base64 ciphertext as "encrypted enough" to ignore where it lands. Encryption protects the content, but the password is the keystone. Do not send the password in the same channel as the ciphertext, and do not store both together — that defeats the entire point.

Privacy