AES Encryption & Decryption (Web Crypto)
AES Encryption & Decryption (Web Crypto) — PBKDF2-HMAC-SHA256 derives a 32-byte key with 120000 iterations and a 16-byte salt. AES-GCM uses a 12-byte IV and appends its 16-byte authentication tag to the ciphertext before Base64 encoding.
About this aes encryption & decryption (web crypto)
AES Encryption & Decryption (Web Crypto) — PBKDF2-HMAC-SHA256 derives a 32-byte key with 120000 iterations and a 16-byte salt. AES-GCM uses a 12-byte IV and appends its 16-byte authentication tag to the ciphertext before Base64 encoding Runs entirely in-memory using Web Crypto primitives to keep sensitive tokens, certificates, and cryptographic keys secure from third-party interception.
Encoding & cryptographic principles
Derives a 256-bit key with PBKDF2-HMAC-SHA256 (120,000 iterations) and encrypts with AES-GCM and a 128-bit tag. Encryption generates a random 16-byte salt and 12-byte IV only when those fields are omitted; supplied Base64 salt and IV are used as given. Decryption requires explicit salt, IV, and ciphertext.
Worked verification example
Scenario: Reproduce a four-byte AES-GCM test vector. This public password, salt and IV are for this test only; never reuse this combination for real messages.
Sample input:
Processing: PBKDF2-HMAC-SHA256 derives a 32-byte key with 120000 iterations and a 16-byte salt.
Illustrative output:
Security parameters & input constraints
A nonempty password is required. Decryption requires valid Base64 salt (16 bytes), IV (12 bytes), and ciphertext of at least 16 bytes; a wrong password or altered data fails authentication. Password-based local encryption does not manage or store keys.
Cryptographic digests, encoded strings, and signatures generated by AES Encryption & Decryption (Web Crypto) should be verified against target authentication systems before production use.
Client-side Web Crypto boundary
Key derivation, hashing, and encoding in AES Encryption & Decryption (Web Crypto) execute in local memory using Web Crypto APIs without remote socket transmission.
Cryptographic specifications & RFC standards
Technical specifications and cryptographic RFC standards governing algorithms and key representations:
- NIST FIPS 197 (Advanced Encryption Standard - AES)
- NIST SP 800-38D (Recommendation for Block Cipher Modes of Operation: GCM)
AES Encryption & Decryption (Web Crypto) verification · Audit standards
How to use it
- Enter JSON with operation encrypt, plaintext and a password; decryption instead needs ciphertext, salt and IV from an earlier result.
- Run locally: PBKDF2-SHA-256 derives an AES-256-GCM key with 120,000 iterations and encrypts or authenticates/decrypts.
- Copy the Base64 ciphertext, salt and IV for later decryption, or read the returned plaintext.
Modern Symmetric Encryption: AES-GCM vs AES-CBC and Authenticated Data (AEAD) →
An in-depth cryptographic guide exploring AES block cipher operations, CBC padding oracle attacks, Galois/Counter Mode (GCM), nonce reuse catastrophes, and Web Crypto APIs.
Frequently asked questions
Which AES inputs are accepted?+
Submit a JSON object. `operation` is `encrypt` only when missing or `null`; `encrypt` and `decrypt` are the only accepted values. The password is `password`, falling back to `key` only when `password` is missing or `null`, and it must be a non-empty string.
How do I encrypt text with supplied values?+
Submit `{ "operation": "encrypt", "password": "pass", "plaintext": "abc", "salt": "AAECAwQFBgcICQoLDA0ODw==", "iv": "AAECAwQFBgcICQoL" }`. The result contains base64 `ciphertext`, `iv`, and `salt`; omitting `salt` and `iv` during encryption instead creates a new 16-byte salt and 12-byte IV.
What is required to decrypt?+
Use `operation: "decrypt"` with the same non-empty password, 16-byte base64 `salt`, 12-byte base64 `iv`, and base64 `ciphertext` from encryption. A wrong password or changed authenticated value produces an AES authentication failure.
Which cryptographic format does it use?+
It derives a 256-bit AES-GCM key with PBKDF2, SHA-256, and 120000 iterations. This helper does not define a key-storage, sharing, or message protocol.