Cryptography & Ciphers
AES Encryption
Encrypt text or hex bytes with AES-GCM and a fresh random IV. Save the JSON envelope; legacy CBC and CTR modes stay available.
This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.
GCM authenticates the encrypted bytes and associated data. Optional associated data stays readable, but changes cause decryption failure.
GCM returns a JSON envelope containing ciphertext and decryption metadata. Legacy modes return bare ciphertext.
- Encrypt a short secret or configuration value with a key your application already manages.
Sources: NIST SP 800-38D: GCM authenticated encryption; OWASP cryptographic storage guidance
Select a mode, key, and input format
- Enter the key and select its Key format.
- Choose Input format UTF8 for text or Hex for bytes.
- Keep Mode GCM unless you must match a legacy system.
- Select Encrypt and save the complete result with its settings. Keep the key separately.
Envelope compatibility and legacy modes
- The tool does not derive a key from a password.
- Other libraries must implement this site’s envelope fields and associated-data rule.
- CBC, CFB, OFB, CTR, and ECB do not detect tampering.
Reproduce a CBC ciphertext
Input: Hello, world!
Settings: Key format Hex, Key 000102030405060708090a0b0c0d0e0f, IV format Hex, IV 101112131415161718191a1b1c1d1e1f, Mode CBC (legacy, unauthenticated), Input format UTF8, Output Hex, Include IV in output Off
Result: 60e541edae5816c353d97f91a5c605a5
CBC padding extends the 13-byte input to one 16-byte block. The result therefore has 32 hex digits.