TASK

Encrypt a large file with AES in chunks

Encrypt files too large for a single AES operation by processing them in chunks with a streaming mode, then decrypt to recover.

1

For large files (hundreds of MB or GB), loading everything into memory for a single AES call is impractical. Process the file in fixed-size chunks (e.g. 1 MiB), each with its own IV, and concatenate the ciphertext chunks.
2

AES Encryptor →
For each chunk: derive the key once (from passphrase), generate a fresh IV per chunk, encrypt, and output IV || ciphertext for that chunk. The key derivation is amortized — do it once.
3

AES Decryptor →
To decrypt: for each IV || ciphertext chunk, decrypt with the same key and IV, then concatenate the plaintext chunks in order.
4

Base64 Encoder →
If the encrypted output must be text-safe (for JSON or email), Base64-encode each chunk or the full ciphertext.
5

Use GCM or CTR mode for streaming — they do not require padding and support parallel encryption. Never use ECB. For authenticated streaming, use GCM per chunk or encrypt-then-MAC the whole file.

Frequently asked questions

Why generate a new IV for each chunk?: Reusing an IV with the same key in GCM or CTR mode is catastrophic — it reveals XOR of plaintexts. A fresh random IV per chunk (stored with the ciphertext) prevents this. In CBC, IV reuse leaks the XOR of the first blocks.
How do I verify the decrypted file matches the original?: Compute a SHA-256 hash of the original before encryption and of the decrypted result. If the hashes match, the round-trip is lossless. For tamper detection, store the hash alongside the ciphertext.

Workflows that solve this

Convert Ascii85 to Base64

Decode Ascii85 and re-encode as Base64 for wider compatibility.

Convert Base2048 to Base64

Decode Base2048 (emoji) and re-encode as Base64 for standard transport.

Convert Base32 to Base64

Decode a Base32-encoded string into raw bytes and re-encode as Base64 for more compact representation.

Convert Base58 to Base64

Decode Base58 and re-encode as Base64 for standard compatibility.

Base64 encode then decode round-trip

Encode text to Base64 and decode it back to verify the round-trip preserves the original data.

Blowfish Encrypt then Base64

Blowfish encrypt then Base64-encode for text-safe transport.

DES Encrypt then Base64

DES encrypt then Base64-encode for legacy compatibility.

Encode a JSON payload for URL transport

Prepare a JSON document for a URL parameter: pretty-print, Base64-encode, then percent-encode — the exact inverse of the nested-parameter decode chain.

AES encrypt then Base64 encode

Encrypt plaintext with AES and encode the ciphertext as Base64 for text-safe transport.

Hash content and encode as Base64

Compute a hash of the input and encode the hash digest as Base64 for compact transport.

Convert Hex to Base64

Decode a hexadecimal string into raw bytes and re-encode it as Base64 for compact transport.

HMAC Sign then Base64 Encode

Generate HMAC signature then Base64-encode for API auth headers.

Morse Encode and Base64 Transport

Encode text as Morse code then Base64-encode for digital transport.

RC4 Encrypt then Base64

RC4 encrypt then Base64-encode for transport.

RIPEMD-160 Hash then Base64

Compute RIPEMD-160 hash then Base64-encode for transport.

Shuffle Text and Base64 Encode

Shuffle text characters then Base64-encode the result.

Unicode Escape and Base64 Encode

Unicode-escape text then Base64-encode for ASCII-safe transport.

URL Encode then Base64 Double Encode

URL-encode then Base64-encode for double encoding in API payloads.

UUencode then Base64

UUencode text then Base64-encode the result for double encoding.

Generate UUID and Base64 Encode

Generate a UUID then Base64-encode it for compact storage.

Learn more

Want to understand why?

Comparing Symmetric vs Asymmetric Encryption

Understand the strengths, weaknesses, and use cases of symmetric and asymmetric cryptography.

How to Compare Cipher Modes of Operation

An intermediate-level guide covering cipher-modes, cbc, ctr. Includes step-by-step instructions, common errors, troubleshooting tips, and security considerations for cipher-modes.

Accountable Encryption

Accountable encryption ensures that key leaks can be traced to a specific responsible party by embedding user-specific ciphertext marks with watermarking or fingerprinting techniques.

Acoustic Attack

An acoustic attack exploits the correlation between key material and sounds emitted during cryptographic operations (coil whine, capacitor vibration) to recover keys via a side channel.

Related tools

Encrypt text or binary data with AES (CBC/GCM/ECB) using Web Crypto API. Free, private, and 100% client-side.

Decrypt AES-encrypted data (CBC/GCM/ECB) using Web Crypto API. Free, private, and 100% client-side.

Encode text or binary data to Base64 online. Free, private, and 100% client-side.

Hash Calculator

Compute MD5, SHA-1, SHA-256, or SHA-512 hashes with hex or Base64 output. Free, private, and 100% client-side.