Runs entirely in your browser — nothing leaves this page.Encrypt / decrypt
Encrypt or decrypt a string with AES-GCM/CBC, ChaCha20-Poly1305 or legacy 3DES — key, IV and output in hex or base64.
A playground, not a protocol
Encrypt or decrypt a string with the ciphers you actually meet in modern systems: AES-GCM and AES-CBC at both key sizes, ChaCha20-Poly1305 and its extended-nonce variant, plus 3DES-CBC for the legacy gear that cannot be upgraded. Keys and IVs are accepted in hex or base64, or derived from a passphrase with PBKDF2.
It is built for debugging and learning: reproduce what a library produced, decode a blob from a config, check which combination of key, IV and mode a legacy system expects. For AEAD ciphers the auth tag is appended to the ciphertext, which is the layout most libraries emit.
Everything stays in the browser — keys included. That also means the usual warnings apply with no server to save you: a nonce reused under the same GCM key is catastrophic, and CBC without a MAC does not protect integrity.
Which cipher should I pick for new code?
AES-256-GCM or ChaCha20-Poly1305. Both authenticate as they encrypt, both are standard in TLS 1.3, and the choice between them is hardware: AES wins with AES-NI, ChaCha20 wins on devices without it. Everything else in the list exists for compatibility.
Why did decryption say authentication failed?
For GCM and ChaCha20-Poly1305 that means the key, the nonce or the data is not exactly what was used to encrypt — including a missing or misplaced auth tag. Check that the tag is appended to the ciphertext and that the encoding (hex vs base64) matches.
Can I reuse an IV if the key changes every session?
The rule is: never reuse a (key, nonce) pair. With GCM, one reuse under the same key leaks the XOR of both plaintexts and can leak the authentication key. Generate a fresh random nonce per message, or use XChaCha20's 24-byte nonce where random generation is always safe.
Why is 3DES here if it's broken?
Because payment terminals, HSMs and old middleware still speak it, and debugging them requires producing bytes they accept. Its 64-bit blocks fall to the Sweet32 birthday attack on long-lived connections — use it to talk to what you cannot change, never for new designs.
Is the passphrase mode as strong as a random key?
Only as strong as the passphrase. PBKDF2 with 600,000 iterations slows guessing, but a weak passphrase is still the weak point. For real systems generate a random key and manage it properly; passphrase mode is for interoperability and experiments.
Related tools: Hash & checksum, HMAC generator and Password hashing.