AES-256-GCM Text Encryption & Decryption

Derive a key from a password with PBKDF2-SHA-256, encrypt text using AES-256-GCM, and output a portable Base64 string.

Encrypt text

Derives a key from the password with PBKDF2 (SHA-256, 250,000 iterations), then encrypts with AES-GCM. The salt, IV, and ciphertext are combined as Base64. All processing stays in your browser.

Plaintext

Password

Result (Base64)

Key features

Derives a 256-bit AES key from the password using 250,000 PBKDF2-SHA-256 iterations.
Creates a fresh 16-byte salt and 12-byte IV with crypto.getRandomValues for every encryption.
Uses the Web Crypto AES-GCM primitive for authenticated text encryption.
Combines the salt, IV, ciphertext, and authentication tag bytes into one Base64 string.
Decrypts Base64 produced by this tool when given the same password.

How to use

Enter plaintext and a password on the Encrypt tab.
Copy and store the Base64 result separately.
Paste that Base64 and the same password on the Decrypt tab to recover the text.

Examples

Store a sensitive note
Turn short text into password-based AES-256-GCM ciphertext for separate storage.
Send encrypted text
Share the Base64 ciphertext and password through separate channels so the recipient can recover the text.

Privacy

Key derivation, encryption, and decryption use Web Crypto in your browser; QuickKit does not store the password or result.

Requirements

The output does not contain the password. Lost passwords cannot be recovered, and practical ciphertext security depends on password quality.

Common questions

Will encrypting the same text and password produce the same result?: No. A fresh 16-byte salt and 12-byte IV make the Base64 output different each time. Each result still decrypts with the same password.
Can this decrypt ciphertext from another AES tool?: This tool reads its own Base64 layout of salt, IV, and AES-GCM ciphertext. Other ciphertext formats are not directly compatible.