About the AES GCM Encrypt Decrypt Online Free Tool

The AES GCM Encrypt Decrypt Online Free Tool encrypts text to Base64 ciphertext or decrypts Base64 ciphertext back to text using AES-GCM. It derives a 256-bit key from your passphrase with PBKDF2 and uses a 12-byte IV for short local testing workflows.

The cryptographic operation runs locally in your browser with Web Crypto when available. Use it for experiments and fixtures, not as a replacement for audited production key management.

How to Encrypt or Decrypt AES-GCM Online

1. Choose encrypt or decrypt mode.
2. Enter the passphrase and input text.
3. For decryption, paste the matching Base64 IV and KDF salt generated during encryption.
4. Run AES-GCM and copy the ciphertext, IV, salt, or plaintext result.

Choosing Options Correctly

Mode:
Use encrypt for plaintext. Use decrypt only when the input is Base64 ciphertext and the IV and salt are the exact Base64 values from encryption.

IV:
AES-GCM requires a unique IV for each encryption. This tool generates one for encrypt mode and requires it for decrypt mode.

KDF salt:
The passphrase is stretched with PBKDF2-HMAC-SHA256 at 210,000 iterations using a fresh random 16-byte salt per encryption, so the same passphrase never derives the same key twice. Decryption needs that exact salt.

Common Use Cases

• Testing how an app handles AES-GCM ciphertext and IV fields.
• Creating short encrypted fixtures for local development.
• Learning why passphrase, ciphertext, and IV must match exactly.

Quick FAQ

Why did decryption fail?
AES-GCM rejects output if the passphrase, salt, IV, ciphertext, tag, or additional authenticated data does not match exactly. A wrong or missing salt derives a different key and fails the same way a wrong passphrase does.

Can I reuse an IV?
No. Reusing an IV with the same key in AES-GCM can break security. Use a fresh random IV for each encryption.

Is this suitable for production secrets?
Use it for learning, testing, or local checks. Production encryption should use reviewed application code and key management.

What should I save with the ciphertext?
You need the IV, authentication tag, algorithm settings, and any salt or KDF parameters needed to recreate the key.