AES Encryption Online | AES-256-CBC Text Encryptor

Q: Is a password converted into a key with PBKDF2?

No. The supplied key bytes are padded or truncated to 32 bytes. The field label does not imply a password-based key-derivation step.

Q: Why does the same input encrypt differently each time?

Each operation generates a random 16-byte IV and prefixes it to the ciphertext. Keep that prefix for decryption.

Q: Is the result always Base64?

No. The selected Hex (lower), Hex (UPPER), or Base64 radio button controls the actual representation, even though the output label mentions Base64.

Q: Does this ciphertext include an authentication tag?

No. The current CBC output contains an IV and ciphertext without an authentication tag. Use an authenticated encryption design in applications that need tamper detection.

Q: Is the text processed entirely in my browser?

No. The current form sends its input to the calculation API. Use non-sensitive sample data when testing.

AES encryption transforms text or encoded bytes into ciphertext using AES-256-CBC in this form. Supply a key, choose Hex or Base64 output, and copy the result for a compatible decryption test. Each result includes a fresh random IV before the encrypted bytes.

Input Type

Input Encoding

Auto / Live

Plaintext

Key Size

Mode

Padding

Key Type

Key Encoding

Key

IV Encoding

Passphrase

Hash

Format

Custom Iteration

Output Encoding

Encrypted Ciphertext

How to use AES Encryption

Use the steps below to encrypt a test message.

Encrypt a test message

Type Hello or another non-sensitive test message into Plaintext. Set Input Encoding: to UTF-8 for normal text.
Keep Encryption Key & Parameters enabled. Enter the key in Encryption Key / Password and choose its representation with Key Encoding (Search/Type):.
Choose Hex (lower), Hex (UPPER), or Base64. The output label mentions Base64, but the selected radio button determines the representation.
Keep Auto / Live on to update the result as you edit. To work manually, turn Auto / Live off and click Run.
Read Encrypted Ciphertext (Base64). Keep the complete result, including the IV prefix, and record the selected representation.
Click Copy to copy the result. Use Clear where shown, or a field's clear control, to clear the text.

For a round-trip test, encrypt Hello using the UTF-8 key 12345678901234567890123456789012 and select Base64. Decrypt that complete output with the same key to recover Hello. A random IV means ciphertext changes between runs.

Key bytes and fixed cipher settings

The cipher is AES-256-CBC with standard block padding. The key is used as raw bytes: values shorter than 32 bytes are zero-padded and longer values are truncated to 32 bytes. Despite the Password label, no password-based key derivation runs. Use exactly 32 test key bytes for predictable interoperability.

Keep the IV with the ciphertext

The output is the random 16-byte IV followed by ciphertext, encoded as selected. There is no separate IV, mode, padding, or key-derivation control. CBC output has no authentication tag, so decryption success alone does not establish authenticity.

Frequently asked questions

Which AES mode is used?

The current form uses AES-256-CBC with standard block padding. It does not expose GCM, CTR, ECB, or another mode selector.

Is a password converted into a key with PBKDF2?

Why does the same input encrypt differently each time?

Is the result always Base64?

Does this ciphertext include an authentication tag?

Is the text processed entirely in my browser?

Egor Volchenko Developer & Author

Hi! I’m a WordPress developer with over 10 years of experience. I love Tailwind CSS, clean code, and intuitive interfaces. I’m currently working on million.tools — a service with convenient online tools for everyday tasks. I’m building it from scratch with great attention to detail and user experience.

AES Encryption