Online AES Encryption Tool: Symmetric Encryption Guide

What Is AES Encryption

AES (Advanced Encryption Standard) is the most widely used symmetric encryption algorithm. Adopted by NIST in 2001, it remains the gold standard for government, banking, and enterprise systems worldwide.

Symmetric encryption means the same key is used for both encryption and decryption — anyone with the key can encrypt and decrypt data. Ready to try it yourself? Our free AES encrypt/decrypt tool runs AES-GCM entirely in your browser.

Core AES Parameters

AES-GCM: The Recommended Mode

AES-GCM (Galois/Counter Mode) is the currently recommended mode because it provides Authenticated Encryption:

• Confidentiality: Encrypted data cannot be read
• Integrity: Data tampering is detected
• Authenticity: Data source is verified

Ciphertext = AES-GCM-Encrypt(Key, Plaintext, IV, AAD)
Plaintext = AES-GCM-Decrypt(Key, Ciphertext, IV, AAD)

Why Not ECB Mode

ECB (Electronic Codebook) is the simplest mode but has critical security flaws: identical plaintext blocks encrypt to identical ciphertext blocks, preserving data patterns.

PBKDF2 Key Derivation

Using a user password directly as an AES key is insecure because passwords are rarely random enough. PBKDF2 (Password-Based Key Derivation Function 2) derives secure keys through:

1. Password + Salt: Random salt prevents rainbow table attacks
2. Multiple iterations (e.g., 100,000): Increases brute-force cost
3. Fixed-length output: Derives the 256-bit key needed for AES-256

Choosing the iteration count

OWASP 2023 recommends at least 310,000 iterations for PBKDF2-HMAC-SHA256. Higher iterations increase brute-force cost but slow down legitimate users, especially on mobile. Common trade-offs:

ToolVault's AES tool defaults to 100,000 iterations (OWASP baseline) with three selectable tiers: 100k / 310k / 600k. The iteration count is embedded in the ciphertext header (v2 format), so decryption auto-detects it without manual matching.

How to Use an Online AES Encryption Tool

Using ToolVault's AES Encrypt/Decrypt Tool:

Encrypt

1. Enter plaintext data
2. Enter a passphrase (12+ characters recommended)
3. Choose a security level (PBKDF2 iterations: 100k / 310k / 600k)
4. Click Encrypt
5. Copy the resulting ciphertext (Base64 encoded)

Decrypt

1. Enter ciphertext (Base64 encoded — line breaks and spaces are tolerated)
2. Enter the passphrase
3. Click Decrypt (iteration count is auto-detected from the ciphertext header, no manual selection needed)
4. The plaintext appears in the output area

Payload format

The tool outputs a base64-encoded composite payload in two compatible formats:

• v1 (default 100k iterations): salt(16 bytes) | iv(12 bytes) | ciphertext+auth tag
• v2 (non-default iterations): magic "TVA2"(4 bytes) | iterations(4 bytes, big-endian) | salt(16) | iv(12) | ciphertext+tag

Decryption auto-detects the format. v1 ciphertext remains decryptable forever. Pasted ciphertext with line breaks or spaces is handled, and base64url style (-_ instead of +/) is also accepted.

AES in Programming Languages

JavaScript / Web Crypto API

async function encrypt(data, password) {
  const encoder = new TextEncoder();
  const salt = crypto.getRandomValues(new Uint8Array(16));
  const iv = crypto.getRandomValues(new Uint8Array(12));
  
  const keyMaterial = await crypto.subtle.importKey(
    'raw', encoder.encode(password),
    'PBKDF2', false, ['deriveKey']
  );
  const key = await crypto.subtle.deriveKey(
    { name: 'PBKDF2', salt, iterations: 100000, hash: 'SHA-256' },
    keyMaterial,
    { name: 'AES-GCM', length: 256 },
    false, ['encrypt']
  );
  
  const ciphertext = await crypto.subtle.encrypt(
    { name: 'AES-GCM', iv },
    key, encoder.encode(data)
  );
  
  return { ciphertext, salt, iv };
}

Python

from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
import os

def encrypt(plaintext: str, password: str) -> bytes:
    salt = os.urandom(16)
    iv = os.urandom(12)
    
    kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32,
                      salt=salt, iterations=100000)
    key = kdf.derive(password.encode())
    
    aesgcm = AESGCM(key)
    return aesgcm.encrypt(iv, plaintext.encode(), None)

Security Best Practices

1. Never implement your own encryption: Use audited standard libraries (Web Crypto API, OpenSSL, BoringSSL)
2. Random IV for every encryption: Even encrypting the same content produces different ciphertext with different IVs
3. Separate key and ciphertext storage: Keys in key management services, ciphertext in databases
4. Use authenticated encryption: Prefer AES-GCM over AES-CBC
5. Tune iteration count to data sensitivity: Long-term stored data warrants 310k+ iterations

The parameter mismatch table

Most "AES is broken" reports are parameter mismatches between encrypt and decrypt sides. The pairs that must match exactly:

The silent ones are the dangerous ones — mode mismatches can "decrypt" into garbage without error, which is why authenticated modes (GCM) that fail loudly are worth their constraints.

FAQ

How Much More Secure Is AES-256 vs AES-128?

Practically, both are sufficiently secure. AES-128's key space is 2^128 — brute-forcing it would take longer than the universe's age. AES-256 provides a larger security margin and is the choice for government-grade applications.

Are Online AES Tools Secure?

ToolVault's AES tool runs entirely in the browser via the Web Crypto API — passwords and data never leave your device. However, ensure you're in a secure environment and be aware of browser extensions that might access your data.

Does Encryption Increase Data Size?

Slightly. AES-GCM output includes ciphertext + authentication tag (16 bytes) + IV (12 bytes) + salt (16 bytes). v2 format adds 8 more bytes of header. The overhead ratio is higher for small data but negligible for large data.

Are Higher Iteration Counts Always Better?

No. Iterations increase brute-force cost but also increase wait time for legitimate users. 100k is barely noticeable on desktop, while 600k may take ~2 seconds on low-end phones. Choose based on data sensitivity and storage duration.

What If My Pasted Ciphertext Has Line Breaks or Spaces?

The tool automatically strips ASCII whitespace (spaces, line breaks, tabs) from pasted ciphertext and also accepts base64url style (-_ instead of +/). Paste directly without manual cleanup.

The mode decision: GCM unless a legacy constraint says otherwise

AES modes in practice: GCM (authenticated encryption — confidentiality plus integrity in one pass, hardware-accelerated, the default answer since 2015), CBC (legacy — encryption without authentication; pairing with HMAC creates the encrypt-then-MAC discipline most CBC deployments get subtly wrong, and padding-oracle attacks prey on the difference), ECB (never — identical blocks produce identical ciphertext; the penguin image is the classic demonstration), and CTR (stream-like, parallelizable, but unauthenticated like CBC). The migration question every legacy system faces: CBC-to-GCM is not a mode swap (different key derivation of the nonce/IV semantics, different output format — GCM appends a 16-byte tag); treat it as a new cipher version with dual-accept migration, not a drop-in.

Nonces and IVs: where GCM is brittle

GCM's nonce is the sharpest foot-gun in mainstream crypto: reuse a key/nonce pair twice and the authentication key leaks (forgery becomes possible — worse than confidentiality loss). The rules: never generate GCM nonces from a weak random source for high-volume encryption (96-bit random collision risk grows quadratically — at a billion messages the odds are real); prefer deterministic counter nonces (96 bits = 32-bit device prefix + 64-bit counter — collision-free by construction) or a 96-bit random with key rotation far before the birthday bound; and never let two systems encrypt under the same key with independently-generated random nonces. NIST's limit: 2^32 encryptions per key — rotation schedules fall out of that number.

Implementer's note

The default PBKDF2 iteration count (100,000) is the OWASP baseline — barely noticeable on desktop, acceptable on mobile. The tool exposes three tiers (100k / 310k / 600k) because different data deserves different protection levels. The iteration count is embedded in the ciphertext header (v2 format), so decryption auto-detects it without requiring the user to remember which tier was used. Legacy v1 ciphertext (no header, 100k iterations) remains decryptable for backward compatibility.

This article is brought to you by ToolVault. Browse more online tools on the homepage.