AES Encrypt
Encrypt and decrypt text with AES-256-GCM in the browser. A password is stretched with PBKDF2; output is Base64(salt + IV + ciphertext). Useful for sharing a short secret over a side channel you control. Keys never leave the tab.
Runs in your browser. Nothing is uploaded.
About this tool
Encrypt and decrypt UTF-8 text with AES-256-GCM in Web Crypto. A password is stretched with PBKDF2 (SHA-256, 100k iterations, random 16-byte salt). Output is Base64 of salt + 12-byte IV + ciphertext so a single string is enough to decrypt later.
How to use: type a password, paste plaintext, Encrypt, copy the Base64. Decrypt with the same password. Wrong passwords fail authentication (GCM) instead of returning garbage. Empty password is rejected.
Example: a short note becomes a Base64 blob you can paste into a ticket you control. This is not a password manager, KMS envelope encryption, or a substitute for TLS. The sample password on this page is for demo only. Pick your own.
Keys are derived in the tab and never sent to ToolBuddy. Related: hash generator for digests, password generator for creating the passphrase. After load, encrypting works offline.
FAQ
Related Crypto tools
Hash Generator
Generate cryptographic hashes (SHA-256, SHA-1, MD5, and more) from text using Web Crypto in your browser. Create checksums for files-as-text, compare digests, and copy hex output. Hashing never leaves the tab, so test strings and secrets stay private.
HMAC Generator
Compute HMAC-SHA signatures in the browser for webhook secrets and API signing. Paste a message and a key, pick SHA-1 through SHA-512, and copy hex or Base64. Keys stay in the tab.
JWT Decoder
Decode JSON Web Tokens locally to inspect the header, payload, and expiry claims. Paste a JWT and read Base64URL-encoded fields without verifying signatures on a remote service. Ideal for debugging auth flows while keeping tokens off the network.
JWT Encoder
Sign a JSON object into a compact HS256, HS384, or HS512 JSON Web Token in the browser. The HMAC secret stays in the tab, so you can mint a test token without posting it to a hosted encoder.
TOTP Generator
Compute a time-based one-time password from a Base32 secret with HMAC-SHA, the same algorithm authenticator apps use (RFC 6238). Pick SHA-1, SHA-256, or SHA-512, 6 or 8 digits, and a 30- or 60-second step. The secret stays in the tab.
Secret Redactor
Redact JWTs, AWS keys, GitHub tokens, private keys, bearer tokens, and emails in pasted logs. Replacement happens in the tab.