How to use the AES Encryptor
1. Click Generate Key to create a secure random AES key, or paste your own hex key.
2. Choose your key size (AES-256 recommended) and output format (Base64 or Hex).
3. Enter the plaintext you want to encrypt in the input field.
4. The ciphertext is generated instantly. Copy both the key and ciphertext — you need both to decrypt.
5. Store your key securely — without it, the encrypted data cannot be recovered.
What is it?
AES (Advanced Encryption Standard) is the worldwide standard for symmetric encryption, approved by NIST and used in TLS/HTTPS, disk encryption, VPNs, and file encryption. This tool uses AES in CBC (Cipher Block Chaining) mode with PKCS#7 padding and a randomly generated 128-bit IV per encryption.
A fresh random IV (Initialization Vector) is generated every time you encrypt, even if the key and plaintext are identical. This means two encryptions of the same text produce different ciphertext — a critical security property that prevents pattern analysis. The IV is automatically prepended to the output (first 32 hex chars or the Base64 segment before the colon) so the decryptor can extract it.
AES is symmetric — the same key encrypts and decrypts. You must securely share the key with whoever needs to decrypt the data. The IV can be public (it's included in the ciphertext output), but the key must remain secret.
Example
{"user":"alice","role":"admin"}u7gH4+randomIVhere:ciphertextInBase64==
Each encryption produces a different ciphertext due to the random IV, even for identical plaintext and key.
Benefits
Verify data integrity instantly
Hash comparison confirms whether a file, API response, or downloaded binary has been altered in transit or at rest — without storing the original content.
Authenticate requests and webhooks
HMAC signatures prove a request came from a trusted source and was not modified in transit — the mechanism behind Stripe, GitHub, and AWS webhook security.
Protect sensitive data at rest
AES-256 encryption makes stored content unreadable to anyone without the key — even if your database, S3 bucket, or file system is fully compromised.
Generate credentials that meet security standards
Cryptographically random output from the Web Crypto API satisfies NIST entropy requirements — unlike predictable Math.random()-based alternatives.
Frequently asked questions
What key format does this tool use?
The key must be a hex string. AES-128 needs 32 hex chars (16 bytes), AES-192 needs 48 hex chars (24 bytes), AES-256 needs 64 hex chars (32 bytes). Click 'Generate Key' for a cryptographically random key.
Why does the same plaintext produce different ciphertext each time?
A random 128-bit IV (Initialization Vector) is generated fresh on each encryption. The IV is prepended to the output so the decryptor can read it. This non-determinism is a security feature — it prevents an attacker from detecting repeated messages.
What is the output format — what is the colon in the Base64 output?
Base64 format: <IV in Base64>:<Ciphertext in Base64>. Hex format: <IV as 32 hex chars><Ciphertext as hex>. The decryptor expects this exact format to extract the IV and ciphertext separately.
Is AES-CBC safe to use?
AES-256-CBC is considered secure for most applications when a fresh random IV is used for each encryption (which this tool does). For modern protocols, AES-GCM is preferred because it also provides authentication (prevents tampering). CBC without authentication is vulnerable to padding oracle attacks in network protocols.
Where is the AES decryptor?
Use our dedicated AES Decryptor tool, which accepts the key and ciphertext (including the embedded IV) and recovers the original plaintext.