Encryption in a browser is only meaningful if the key never leaves it. Everything here — key derivation, encryption, decryption — happens in your tab using the Web Crypto API. Load the page, disconnect, and it still works.
Choose GCM
AES-GCM is authenticated encryption: it produces a ciphertext and an authentication tag, and decryption fails if either has been modified. AES-CBC provides confidentiality only. An attacker cannot read CBC ciphertext, but they can modify it, and the decryption will succeed and return altered plaintext.
That distinction produces real vulnerabilities. Padding oracle attacks against CBC recover plaintext entirely by observing which modified ciphertexts produce padding errors. GCM's tag check makes the whole class impossible.
CBC is offered here for interoperating with systems that require it. If you must use it, add a separate HMAC over the ciphertext — encrypt-then-MAC — and verify it before decrypting.
The envelope
Encryption produces a single Base64 string containing everything needed to decrypt except the key:
[16-byte PBKDF2 salt][12-byte IV][ciphertext + 16-byte GCM tag]Store that one string. The salt and IV are not secret and must be kept — losing them makes the ciphertext unrecoverable just as surely as losing the key.
Never reuse an IV
With AES-GCM, reusing an initialisation vector under the same key is catastrophic. Two messages encrypted with the same key and IV allow an attacker to recover the XOR of the plaintexts, and — worse — to forge the authentication tag for arbitrary messages under that key.
A fresh random IV is generated for every operation here. In your own code, never derive an IV from a counter you might reset, and never hardcode one.
Passphrase or raw key
Passphrase derives a key with PBKDF2 at 310,000 iterations. Convenient, and the derivation cost is what protects a weak passphrase. Use a long one — the entropy calculator will tell you whether yours is adequate.
Raw key takes 64 hex characters for AES-256. Correct when the key comes from a key management system or was generated properly by the secret generator.
What this is for, and what it is not
Good for: encrypting a secret before storing it somewhere you do not fully control, protecting a value in transit through an untrusted channel, and understanding how AES-GCM behaves.
Not a substitute for: a key management service, envelope encryption for a database, or disk encryption. Those need key rotation, access control and audit logging that a browser tool cannot provide.
Frequently asked questions
Why does decryption fail with the right passphrase?
Check the cipher mode matches — an envelope encrypted with GCM will not decrypt as CBC. Check the whole envelope was copied, including the salt and IV at the start. And check the key source: a passphrase-derived key is different from a raw key even if the strings look similar.
Is AES-128 enough?
Yes. AES-128 is not breakable by any known means and is faster. AES-256 is chosen here by default largely because it is what compliance regimes ask for, and the performance difference is negligible at these sizes.
Can I decrypt something encrypted elsewhere?
Only if it uses the same envelope layout: salt, then IV, then ciphertext with the tag appended. Most implementations differ in how they package these, so cross-tool decryption usually needs the components separated manually.
What is the GCM tag?
A 16-byte authenticator appended to the ciphertext. Decryption recomputes it and refuses to return any plaintext if it does not match. That refusal is the feature: GCM will not hand you data it cannot vouch for.