AES Encrypt/Decrypt Tool

Key is 32 bytes (256-bit) stored in localStorage as base64.

Basic Instructions

Key is created automatically: On first load a 256-bit key is generated and saved to localStorage.
View or edit key: The AES key field shows the current base64 key. You may paste your own 32-byte key (base64). Invalid sizes are rejected.
Encrypt: Type your plaintext and click Encrypt. Output is base64( IV || ciphertext ). IV is 12 bytes generated per message.
Share: Send the base64 ciphertext to the recipient who has the same key.
Decrypt: Paste base64 ciphertext and click Decrypt. The tool extracts IV and verifies the GCM tag.
Rotate key: Click Generate New Key to replace the key. Old ciphertexts need the old key.
Remember: Anyone with this key can decrypt your messages

Open your RSA tool. Click Show My Public Key and send that public key to the recipient, or paste their public key into the RSA tool if they already shared it.
In this AES tool, copy the AES Key (base64, 32-byte key).
In the RSA tool, paste that base64 key into Plaintext to Encrypt and click Encrypt.
Send the produced ciphertext to the recipient. The AES key is short enough for RSA-OAEP-2048, so no chunking (multiple RSA messages) is needed.

Trust check: Verify the recipient's RSA public key out of band. If an attacker swaps keys, you leak your AES key.

In the RSA tool, paste the received ciphertext into Ciphertext and click Decrypt.
Copy the decrypted base64 string. That is the AES key.
In this AES tool, paste it into the AES Key field. You now share the same key and can encrypt/decrypt messages.

Rotate if needed: Use Generate New Key in either tool to rotate. Keep old keys if you must decrypt old messages.

AES PSK Key

Loaded.

Plaintext

Output is base64( 12-byte IV || ciphertext ).

Ciphertext (base64)

Decrypted Output