CTR (Counter Mode)

CTR mode turns a block cipher into a stream cipher: it encrypts an incrementing counter to generate a keystream that is XORed with the plaintext, supporting parallelism and random access, but provides no integrity.

Purpose

It offers stream-cipher padding-free operation while allowing parallel encryption and random-access decryption.

Mechanism

Encryption: C_i = P_i ⊕ E_K(nonce || counter_i). The counter increments from an initial value, and the nonce must be unique. Blocks are independent, so it parallelizes. It is unauthenticated — pair it with a MAC (e.g., CCM) or use GCM.

Use cases

AES-CTR streaming encryption
Random access to encrypted data (e.g., disks)
Parallel encryption acceleration
The underpinning of AES-GCM

Examples

Input

nonce + counter 0,1,2...

Output

keystream blocks

Parallelizable

Common errors

Nonce reuse replays the keystream: Use a unique nonce per message

Related terms

CBC (Cipher Block Chaining)

CBC mode XORs the previous ciphertext block with the current plaintext before encrypting, so identical plaintext blocks yield different ciphertexts; it requires a random IV but provides no integrity authentication.

GCM (Galois/Counter Mode)

GCM is an AEAD mode that combines CTR encryption with GHASH authentication, providing confidentiality and integrity at once, and is the preferred mode of TLS 1.2/1.3.

Mode of Operation

A mode of operation is a scheme that lets a block cipher handle arbitrary-length data, defining how multiple plaintext blocks are chained during encryption; common ones include ECB, CBC, CTR, and GCM.

A nonce (number used once) is a value used only once in encryption; similar to an IV but emphasizing uniqueness over randomness, it is common in stream ciphers and AEAD.

Related tools

Encrypt text or binary data with AES (CBC/GCM/ECB) using Web Crypto API. Free, private, and 100% client-side.

AES-CTR Encryptor

Encrypt text with AES in CTR mode (NIST SP 800-38A, native Web Crypto implementation) — a real algorithm verified byte-for-byte against official NIST test vectors (F.5.1/F.5.3/F.5.5). 128/192/256-bit key, 16-byte IV (the full initial counter block). Free, private, and 100% client-side. Never reuse an IV with the same key.

AES-CTR Decryptor

Decrypt AES-CTR ciphertext (NIST SP 800-38A, native Web Crypto implementation) — a real algorithm verified byte-for-byte against official NIST test vectors. Key must be 16, 24 or 32 bytes, IV exactly 16 bytes (the same full initial counter block used for encryption). Ciphertext input format follows the output format option (hex or base64). Free, private, and 100% client-side.

References