AEAD Encrypt / Decrypt
Free authenticated encryption tool — encrypt and decrypt with AES-128/256-GCM, ChaCha20-Poly1305 or XChaCha20-Poly1305, including additional authenticated data. Tampering is detected rather than silently decrypted. Runs locally in WebAssembly.
Runs entirely in your browser — nothing you enter is uploaded or stored.
Authenticated encryption
Encryption alone answers only one question — can an eavesdropper read this. It says nothing about whether what arrived is what was sent. AEAD answers both: the ciphertext carries an authentication tag, and decryption fails outright if a single bit has been altered.
Why the unauthenticated modes are absent
This tool offers no CBC, CTR or ECB, and that is deliberate on the engine's part rather than an omission. Those modes are usable correctly only if you add a MAC yourself, in the right order, and compare it in constant time. Systems get this wrong often enough that the safe design is to not offer the choice. If you are decrypting something that used CBC, you need a library and a careful implementation, not a web page.
The nonce is the sharp edge
Everything here is safe except reusing a nonce with the same key. Under GCM that single mistake leaks the XOR of the affected plaintexts and can expose the authentication subkey, which lets an attacker forge messages you never sent. With 96-bit nonces, random generation is fine up to roughly a few billion messages per key; past that, use a counter. XChaCha20-Poly1305 widens the nonce to 192 bits specifically so random ones never collide in practice.
Frequently asked questions
Why are there no CBC or ECB options?
Because they let you build something broken without noticing. CBC and CTR provide confidentiality only: an attacker who cannot read your ciphertext can still modify it, and predictably. That is what padding-oracle attacks exploit. ECB does not even hide structure — the famous encrypted-penguin image is ECB. Every algorithm here is AEAD, so tampering is detected on decryption rather than silently succeeding.
What is AAD for?
Additional authenticated data is authenticated but not encrypted. It is for context that travels in the clear and must not be swapped — a message ID, a user ID, a version number. Bind them as AAD and an attacker cannot take a valid ciphertext from one context and replay it in another, because decryption fails when the AAD differs.
Do I have to keep the nonce secret?
No. Nonces are transmitted alongside the ciphertext and that is expected. What they must be is unique — never the same nonce with the same key twice. Reuse under GCM leaks the XOR of the two plaintexts and can expose the authentication subkey, turning a confidentiality failure into a forgery capability. XChaCha20 exists precisely so that random nonces are safe at scale: 192 bits is wide enough that collisions do not happen.
Should I use this for real data?
Use it to understand the mechanism, to check an implementation against a known input, or to move something small between two places you control. Do not build a workflow around pasting production keys into a browser tab. Real encryption belongs in your application, using the same primitives from a library.