AES Encrypt & Decrypt
Online Tool
Encrypt or decrypt text with passphrase AES (CryptoJS OpenSSL format) in your browser. Demo and learning only—not a production KMS. Nothing is uploaded.
Demo and learning only — you own key management. Passphrases and plaintext stay in your browser and are never uploaded. Not a production KMS.
Fixed preset: CryptoJS passphrase AES (OpenSSL-compatible Salted__ Base64, AES-CBC, EvpKDF, random salt). Same plaintext can yield different ciphertext each run.
- Input0
- Output0
- OptionsEncrypt
- PresetCryptoJS / OpenSSL
Input
Encrypted
What is this tool?
This AES encrypt and decrypt tool turns short plaintext into a portable ciphertext string with a passphrase, then restores the text with the same passphrase. Processing stays in your browser via CryptoJS-compatible passphrase AES.
The fixed preset is OpenSSL-style: AES-CBC, EvpKDF-derived key and IV, a random 8-byte salt, and Base64 ciphertext whose decoded bytes begin with Salted__. Because the salt is random, encrypting the same plaintext twice usually yields different ciphertext—both decrypt with the same passphrase.
Treat this as a demo and learning utility. You remain responsible for passphrase strength, storage, and sharing. It is not authenticated encryption (no GCM tag), not raw key wrapping, and not a substitute for a cloud KMS or secrets manager.
Common use cases
- Check that a known CryptoJS/OpenSSL-style ciphertext decrypts with a passphrase you already have
- Demo passphrase-based AES for teaching or local experiments
- Round-trip short notes before wiring real application crypto
How to use
- Choose Encrypt or Decrypt.
- Paste plaintext (or ciphertext) and enter the passphrase. Use show/hide if you need to verify typing.
- Click Encrypt or Decrypt (explicit run—results are not live-as-you-type).
- Copy the ciphertext or recovered plaintext. Sample loads a harmless demo note and passphrase.
Examples
| Input / setting | Output | Notes |
|---|---|---|
Encrypt hello + passphrase demo | Base64 starting with U2FsdGVkX1… | Decodes to OpenSSL Salted__ + salt + ciphertext. |
| Same plaintext + same passphrase, encrypt twice | Two different Base64 strings | Random salt each run; both decrypt with demo. |
| Decrypt with wrong passphrase | Empty / error | Wrong password or non-matching format—tool reports which case when possible. |
Paste non-Salted__ Base64 | Format error | Expects this tool’s CryptoJS OpenSSL preset, not raw AES hex blobs. |
Practical pitfalls
- Transit protection ≠ key sharing: Sending ciphertext over chat still requires a secure way to share the passphrase. Anyone with both can read the note.
- Not production KMS: No key rotation, audit trail, AEAD, or hardware-backed keys. Prefer AWS KMS, GCP Cloud KMS, Azure Key Vault, or audited libraries with explicit modes.
- Weak passphrases fail quietly at scale: Dictionary passphrases are offline-bruteforceable against captured ciphertext. Use long random secrets for anything sensitive—and still prefer real app crypto.
References
Last reviewed: 2026-07-27
Frequently asked questions
- Which AES mode and format does this use?
- CryptoJS passphrase encryption: AES-CBC with key and IV derived via EvpKDF from your passphrase, a random 8-byte salt, and OpenSSL-compatible Base64 that starts with a Salted__ payload. It is not raw AES with a hex key you paste, and not AES-GCM.
- Can Utill.net recover my passphrase?
- No. Encryption runs only in your browser. Lost passphrases cannot be recovered by us or anyone else.
- Is encrypting text enough to share secrets safely?
- No. Ciphertext still needs a secure channel or access control, and the passphrase must be shared out of band. Encrypting for transit is not the same as managing keys. For production, use authenticated encryption and a real KMS or secrets manager.
- Should I use this instead of a cloud KMS?
- No. Prefer AWS KMS, GCP Cloud KMS, Azure Key Vault, or an audited app crypto stack with key rotation, audit logs, and AEAD. This page is a local demo utility.