AES-GCM Local Encryption/Decryption
Use PBKDF2-SHA-256 and AES-GCM, with a random salt, to encrypt or decrypt versioned data locally in the browser.
How to use AES-GCM for local encryption/decryption
Plaintext, ciphertext, and passwords are processed only in the current browser and are not uploaded; the page does not save passwords.
Input content and password
Enter the content and passphrase in encryption or decryption mode; back up the original before encrypting important content.
Perform local encryption and decryption
The tool uses a random salt, a random nonce, PBKDF2-SHA-256 and AES-GCM to generate versioned data.
Copy and verify
Copy the complete envelope and immediately try decrypting it with the same passphrase; recovery is impossible if any part is missing.
Limitations and Notes
- A lost password cannot be recovered, and the page cannot determine whether the password is strong enough.
- This tool does not provide key custody, multi-user sharing, key rotation, backup, or disaster recovery.
- Production systems should still use encryption and key management solutions that have undergone an independent security audit.
FAQ
Why is the ciphertext different each time with the same plaintext and password?
A new random salt and nonce are generated each time; this is normal behavior that prevents identical inputs from producing identical ciphertext.
Can data generated by older versions of the page be decrypted?
The new format includes explicit version and parameter fields; legacy data without these fields will not be decrypted by guesswork, to avoid misinterpretation.