AES Encryption and Decryption
AES-256 Text Encryption With a Password

What This AES Encryption Tool Does

This AES encryption tool turns readable text into a scrambled string that only someone with the right password or key can read. Type a message, choose a password, and press Encrypt. To read it again, paste the string on the other side and press Decrypt.

It uses AES-256, the same cipher that protects banking, messaging apps and disk encryption. By default it runs in GCM mode, which also detects if anyone changed the text on the way. CBC and CTR are there too, for systems that expect them.

The work happens inside your browser, through its built-in Web Crypto engine. Therefore your text, your password and your key never reach our server, which is exactly what you want from an encryption tool.

How AES Encryption Works

AES works on fixed blocks of 16 bytes at a time. It takes 16 bytes at a time and scrambles them through 10, 12 or 14 rounds of substitution and mixing, depending on the key size. Without the key, the result looks like random noise, and with it, every byte comes back exactly.

A cipher alone is not enough, though. A mode decides how the blocks connect, and a fresh random value, the IV, makes sure the same message never encrypts the same way twice. So this tool adds a new IV every time and writes it at the front of the output.

Lock Your Text Behind a Password

Most people will use a password, and that is the default. The tool turns the password into a 256-bit key with PBKDF2, running SHA-256 600,000 times over. As a result, anyone trying to guess the password has to repeat all that work for every single guess.

A random salt goes into that step too, so the same password gives a different key each time. The salt is stored at the front of the output, so the other side can rebuild the same key from the same password.

AES Decryption, Step by Step

For AES decryption, paste the encrypted string into the second box, set the same mode and password, and press Decrypt. The tool reads the salt and IV from the front of the string, rebuilds the key and restores the text.

In GCM mode it also checks a 16-byte tag. If even one character was changed, or the password is wrong, the check fails and you get a clear error instead of garbled text. That is one of the main reasons GCM is the default here.

Bring a 256-Bit Key of Your Own

Developers often need to match another system exactly. For that, switch the key source to A raw key and paste a key in hex or Base64. A 32-byte key gives AES-256, and a 16-byte key gives AES-128. If you need a new one, the New random key button makes a secure 256-bit key for you.

In this mode the output is the IV followed by the ciphertext, the layout most libraries use. As a result, you can check that your server and your app agree before you ship.

GCM, CBC or CTR?

Choose GCM unless something forces you not to. It encrypts and also proves the text was not changed, as the article on Galois/Counter Mode explains. CBC and CTR only hide the text, so an attacker could flip bits without you noticing. Therefore the tool warns you whenever you pick them.

AES-128 or AES-256?

Both are safe today. AES-128 uses a 16-byte key and 10 rounds, while AES-256 uses a 32-byte key and 14 rounds. The longer key adds a large safety margin, including against future quantum computers, at a small cost in speed.

With a password, this tool always makes a 256-bit key, so you get AES-256 without thinking about it. With a raw key, the length you paste decides: 32 bytes means AES-256, and 16 bytes means AES-128. The Key size box above the status line always shows which one is in use.

Where AES Comes From

In 2001, after an open contest, the US standards body NIST picked a cipher called Rijndael, designed by Joan Daemen and Vincent Rijmen, and named it the Advanced Encryption Standard. The full rules are in FIPS 197, the AES standard.

More than twenty years later, AES is still unbroken in practice. Most processors even have special instructions for it, which is why encrypting a whole disk no longer slows a laptop down. Today, governments, banks and cloud providers rely on it every single day.

How Safe Is This AES Encryption?

AES is not where attacks usually succeed. AES-256 with a random key cannot be brute-forced with any computer that exists or is planned. In practice, the password is what an attacker goes after, so a long one matters more than anything else.

Use at least 12 characters, or better, four or five random words. Also, keep the password apart from the message: send the encrypted text by email, for example, and the password by phone. If both travel together, the encryption adds very little.

Why Denwix Keeps AES Inside Your Browser

Many online encryption tools send your text to a server, encrypt it there and send it back. That means someone else sees the plain message and the password, even if only for a moment. The Denwix AES page skips that step entirely.

Instead, it calls the Web Crypto encrypt function that every modern browser ships. After the page loads, the AES code runs on your own device, even with the network off.

Decrypting in Other Languages

Because the layout is simple, other programs can read what this tool makes. With a password, take 16 bytes of salt, then the IV, then the rest, and derive the key with PBKDF2-SHA-256 at the same number of rounds. With a raw key, skip the salt.

Python, Node, Java and Go all have AES-GCM and PBKDF2 in their standard libraries or common packages. So a message encrypted here can be opened by a script on your server, and the other way round.

What AES Encryption Is Good For

People use it to send a password or a bank detail through a channel they do not trust, to store notes in a file that others can read, or to test that two systems encrypt the same way. Developers also use it to check their own code against a known-good result.

For secrets you only need to check, not read back, such as login passwords, use a one-way hash instead. Our bcrypt generator is made for exactly that.