Cifrar text with AES and decrypt it back
Symmetrically cifrar un mensaje con un passphrase usando AES-256-GCM, luego descifrar el ciphertext con el mismo clave a recover el original.
- 1
AES is the standard symmetric cipher: the same key encrypts and decrypts. GCM mode provides authenticated encryption — it detects tampering of the ciphertext. Never use ECB or unauthenticated CBC for new data.
- 2 Cifrador AES →
Enter the plaintext and a passphrase. The tool derives a key (PBKDF2), generates a random IV, and outputs ciphertext + IV + salt, typically Base64-encoded.
- 3 Descifrador AES →
Paste the ciphertext output and the same passphrase. The tool recovers the original plaintext. If the passphrase is wrong, GCM mode fails with an authentication error rather than returning garbage.
- 4
Store the passphrase separately from the ciphertext. The IV and salt are not secret and travel with the ciphertext — only the passphrase needs protection.
Preguntas frecuentes
- What happens if I use the wrong passphrase to decrypt?
- With GCM mode, decryption fails with an authentication tag mismatch — you get an error, not garbage text. This is why GCM is preferred over CBC: it detects tampering and wrong keys immediately.
- Is the IV safe to store alongside the ciphertext?
- Yes. The IV (or nonce) is not secret — it only needs to be unique per encryption with the same key. Storing it with the ciphertext is standard practice. Only the key/passphrase must be kept secret.