AES Encryption & Decryption Online: GCM, CBC & CTR with PBKDF2

Encrypt and decrypt with AES-GCM/CBC/CTR and PBKDF2, with byte-level and process-stage visualization.

AES-GCM, AES-CBC and AES-CTR here run through the browser's own SubtleCrypto implementation at 128, 192 or 256-bit key lengths — real, production-grade encryption, not a simplified teaching version. A hand-written XOR cipher sits alongside them specifically because it's the one mode simple enough to trace byte by byte, standing in deliberate contrast to AES's opaque, hardware-accelerated internals.

How to encrypt and decrypt text with AES

  1. Pick AES-GCM (selected by default, and the only mode here that detects tampering), leave Direction on Encrypt, and keep the 256-bit key length unless you must match another system.
  2. Supply key material: click Generate for a random raw hex key, or switch to Passphrase (PBKDF2), type a passphrase and click Generate beside the salt field. Iterations default to 200,000 with SHA-256.
  3. Type the plaintext and press Encrypt. The ciphertext comes out as Base64 (for GCM it already ends with the 16-byte tag), and the nonce or IV is shown separately as hex.
  4. Save what the output does not bundle: the Base64 ciphertext, the IV or nonce, and either the hex key or the passphrase together with its salt, iteration count, hash and key length.
  5. To decrypt, choose Decrypt with the same mode, re-enter that key material, paste the IV or nonce and the Base64 ciphertext, and press Decrypt.

Three real AES modes, and what SubtleCrypto will and won't show you

Encryption itself runs through crypto.subtle.encrypt/decrypt with a native CryptoKey — there is no JavaScript re-implementation of the AES round function, S-boxes or key schedule anywhere in this tool, because SubtleCrypto's implementation is both faster and more trustworthy than anything reimplemented for a browser demo. That also means the round-by-round internals are genuinely opaque; the process trace this tool shows covers key derivation, IV or nonce generation, and the encrypt/decrypt call itself, and never fabricates an internal-state visualization SubtleCrypto doesn't expose.

192-bit keys are offered but not guaranteed: the tool probes your browser at load time by attempting to import a 24-byte key, and disables the 192-bit option with an explanation if that import fails, rather than letting you configure a mode that will error out later. A fresh random IV or nonce is generated for every single operation via the browser's cryptographic random number generator — 96 bits for GCM (the size every interoperable GCM implementation expects) and a full 128-bit block for CBC's initialization vector and CTR's initial counter.

AES modes compared: GCM, CBC and CTR

All three modes run the same AES block cipher on 16-byte blocks. They differ in how consecutive blocks are tied together, whether the message has to be padded to a whole number of blocks, and whether decryption can tell that the ciphertext was changed.

Getting a key: raw hex, or a passphrase through PBKDF2

A raw key can be entered directly as hex, and it has to be exactly 16, 24 or 32 bytes — 128, 192 or 256 bits — or the tool rejects it before it ever reaches SubtleCrypto. The alternative is a passphrase run through PBKDF2, the standard password-to-key derivation function, with a configurable hash (SHA-256, SHA-384 or SHA-512) and a default of 200,000 iterations before the derived bytes are imported as an AES key — that iteration count exists specifically to make brute-forcing a weak passphrase computationally expensive, and it's shown as an explicit stage in the process trace so you can see exactly how many rounds ran.

Common AES errors and fixes

Every message below is one this tool actually shows. Most of them mean one piece of the encryption-time material is missing or slightly different.

XOR: the one mode you can watch happen

SubtleCrypto has no XOR mode, so this one is a from-scratch implementation: each byte of the message is exclusive-ORed against the corresponding byte of a repeating key, and because it's plain byte arithmetic rather than a call into opaque native crypto, every single byte of that operation can be shown — the input byte, the key byte being used (which one, in the repeating cycle), and the output byte, in both hex and binary. XOR is also its own inverse, so the identical operation encrypts and decrypts.

That transparency is also exactly what makes XOR insecure for anything real: a repeating-key XOR cipher is broken almost as easily as a Caesar shift once an attacker has any known or guessed plaintext, or when the message is longer than the key and repeats reveal the key's length. It's included here as an educational contrast to AES, not as a usable cipher.

What this tool doesn't cover

Questions people ask about Modern Symmetric Cipher Lab

Is the AES in this tool actually secure, or is it a simplified demo version?
It's the real thing. Encryption and decryption run through the browser's native SubtleCrypto implementation of AES-GCM, AES-CBC and AES-CTR, the same cryptographic primitive used in production software, not a simplified or weakened reimplementation. What's added on top is only a visible trace of the surrounding process — key derivation and IV generation — since AES's internal rounds are opaque by design.
Which AES mode should I actually pick: GCM, CBC or CTR?
GCM is generally the right default because it provides both encryption and built-in tamper detection through its authentication tag in one step. CBC and CTR encrypt but provide no integrity checking on their own — a corrupted or tampered ciphertext will decrypt into corrupted plaintext without any warning, so either would need a separate authentication step to be used safely in a real system.
Why is the XOR cipher included next to real AES encryption?
XOR is the one mode simple enough to show every single byte-level operation, since it's implemented directly rather than through opaque native crypto — useful for understanding what 'encryption' mechanically means at the byte level. It's also trivially breakable with any known plaintext or a message longer than its key, which is exactly the point: it demonstrates what AES protects against that a naive cipher doesn't.
What happens if I use a passphrase instead of a raw hex key?
The passphrase is run through PBKDF2 with a salt and, by default, 200,000 iterations of a chosen hash function to derive the actual key bytes, rather than being used directly. That iteration count is deliberately expensive to compute, which is what makes brute-forcing a guessable passphrase impractical even though the passphrase itself might be short.
What is AES encryption?
AES, the Advanced Encryption Standard, is the symmetric block cipher NIST standardised in 2001. It encrypts 16-byte blocks under a 128, 192 or 256-bit key. Symmetric means the same key both encrypts and decrypts, so anyone who needs to read your message has to share that key with you.
Should I use AES-128 or AES-256?
Both remain unbroken, and AES-128 is already far beyond brute-force reach. AES-256 adds margin, including against future quantum search, at a speed cost you will not notice for text in a browser. The tool defaults to 256 bits and greys out 192 if your browser rejects 24-byte keys.
Why does decryption fail with an authentication error?
In AES-GCM the tag at the end of the ciphertext is checked before any plaintext is released. One wrong key byte, a different salt or iteration count, the wrong nonce, or a single altered or missing ciphertext character fails that check, and the tool reports the error instead of showing corrupted text.
Is client-side AES encryption safe to use?
The cipher is the browser's native Web Crypto AES, and your text and keys stay on the page. The real risks sit around it: a short passphrase, a lost salt or IV, malware or a hostile extension on your device, or sending the key through the same channel as the ciphertext. Prefer GCM with a long random key.

Related tools on BrakeTools

Content reviewed 2026-09-27.