AES encryption
Encrypt and decrypt text with a shared secret key or password using authenticated AES-256-GCM.
Encrypt and decrypt with the same secret. A random 256-bit key is different from a password; choose the matching mode. Use test data only.
Generate replaces the current key. Save it separately before replacing it; it is not included in the encrypted result.
Round trip: load an example, generate a key (or enter a long password), encrypt, choose “Use encrypted result as input”, then decrypt with the unchanged secret. A wrong secret or altered message fails authentication.
AES-256-GCM uses a fresh random 12-byte IV and a 128-bit authentication tag. Password mode derives the key using PBKDF2-HMAC-SHA-256, 600,000 iterations and a fresh 16-byte salt. The encrypted JSON contains the IV, salt/settings where needed, and ciphertext with its tag—not your secret. Keep the entire JSON for decryption. This versioned OVALK format is not a generic OpenSSL or CryptoJS ciphertext format.
Text limit: 256 KiB of UTF-8 bytes; encrypted JSON limit: 400,000 characters. IVs and salts are not secret; do not remove or edit them. Lost keys/passwords cannot be recovered. Reloading loses the workspace, and Clear does not erase clipboard history or securely wipe memory.
General input limit: 1,000,000 characters per field; AES uses the smaller limits stated above. SHA, HMAC, AES and RSA require HTTPS or localhost and browser Web Crypto. Inputs are processed locally, not stored by these tools or placed in the URL.
These pages do not load the site’s AdSense script. Browser extensions, compromised devices or scripts injected by hosting settings are outside the tool’s control. Use synthetic test data; a public website is not a secure key vault.
Technical references: Web Crypto API, JWT (RFC 7519), Base encodings (RFC 4648).