AES Text Encryption

Type a passphrase and encrypt text with AES-256-GCM authenticated encryption — or decrypt a ciphertext back to plaintext. 100% in your browser, nothing sent to our servers.

AES-256-GCM · PBKDF2-SHA-256 · 200k

Encrypted (Base64)

How to encrypt text

Strong, local, authenticated encryption in four steps.

  1. 1

    Enter your passphrase

    Type a strong passphrase (longer is better). It becomes your encryption key via PBKDF2-SHA-256 with a random salt.

  2. 2

    Choose a mode and paste your text

    Pick Encrypt or Decrypt, then paste plaintext to encrypt or a Base64 ciphertext to decrypt.

  3. 3

    Copy your result

    Encryption produces a Base64 string that is safe to paste or share; decryption recovers the original plaintext. Copy it with one click.

  4. 4

    Manage secrets with Envless

    For production secrets, store encrypted values end-to-end encrypted in Envless so your team can share and access them without plaintext exposure.

Why use the Envless AES encryption tool?

Real Web Crypto encryption from a team that builds encrypted secret management for a living.

Real authenticated encryption

Uses AES-256-GCM, not a toy cipher. The authentication tag detects tampering — if someone modifies the ciphertext, decryption fails instead of returning garbage.

Secure key derivation

Your passphrase is never used directly as a key. PBKDF2-SHA-256 stretches it over 200,000 iterations with a random salt, making brute-force attacks impractical.

100% client-side encryption

Your passphrase and plaintext never leave your device. Everything runs in your browser via the Web Crypto API — no uploads, no server logs, no network requests.

Share encrypted secrets securely

Share the ciphertext freely — only someone with your passphrase can decrypt it. For team-wide secrets, store the values end-to-end encrypted in Envless.

AES encryption FAQ

Everything you need to know about encrypting text locally with AES-256-GCM.

Real encryption. It uses AES-256-GCM (Galois/Counter Mode), a NIST-approved authenticated cipher. Every ciphertext includes an authentication tag to detect tampering. If the passphrase or ciphertext is wrong, decryption fails.

No. Everything runs in your browser using the Web Crypto API. Your passphrase and plaintext never leave your device — there are no uploads, no logging, and no network calls.

Your ciphertext becomes permanently unrecoverable. There is no reset or recovery — that is what makes the encryption strong. Store your passphrase in a password manager, not a text file.

Yes. Share the Base64 ciphertext freely — it is safe on untrusted channels. Only someone with the correct passphrase can decrypt it. Share the passphrase separately, through a secure channel.

Longer is always stronger — aim for 12+ characters mixing cases, numbers, and symbols. PBKDF2 adds 200,000 iterations of hashing, so even moderate passphrases resist brute force, but length matters most.

Yes. A cryptographically random 16-byte salt and 12-byte IV are generated for every encryption and prepended to the ciphertext. The decryptor extracts them automatically — you never manage them.

More free tools

Other free, 100% client-side tools from the Envless team.

Secret & Password Generator

Generate strong passwords, passphrases, PINs, and API keys — free and 100% client-side.

Password generator

.env File Converter

Convert .env files to JSON, YAML, Docker, Kubernetes, shell exports, and TOML — right in your browser.

.env converter

JWT Decoder

Decode JWT headers, payloads, and claims — with local expiry checks and HS256/RS256 verification.

JWT decoder

.env Validator

Lint your .env for duplicate keys, unquoted values, and secrets left in plaintext.

.env linter

.env.example Generator

Strip the values from a .env to create a safe, shareable .env.example for git.

.env.example

Kubernetes Secret Generator

Turn a .env into a ready-to-apply Kubernetes Secret with Base64-encoded values.

Kubernetes secret

JWT Generator

Build and sign HS256/384/512 or RS256/ES256 JSON Web Tokens locally — set your own claims and key.

JWT generator

.env Diff

Compare two .env files and spot missing, extra, and changed keys in seconds.

.env diff

Hash Generator

Hash text or a file with SHA-256/384/512, or create an HMAC keyed hash — instantly and locally.

SHA-256 hash generator

Base64 Encode / Decode

Encode text or a file to Base64, decode it back to a file, or emit a data URI — 100% local.

Base64 encode decode

RSA & EC Key Pair Generator

Generate RSA and ECDSA key pairs and export them as PEM, OpenSSH SSH key, or JWK.

RSA key generator

Connection String Parser

Parse a DATABASE_URL into host, port, user, password, and params — and rebuild it.

connection string parser

UUID Generator

Generate random UUID v4, time-sortable UUID v7, or the NIL UUID in bulk — free and local.

UUID generator

Password Strength Checker

Measure password entropy in bits and estimate crack time — nothing is sent anywhere.

password strength checker
Get Started

Ship secrets, not chaos.

Start free today and discover why developers trust Envless for end-to-end encrypted, versioned secrets across every environment.