Introduction
Need to encrypt a payload with AES-128, AES-192, or AES-256 and see exactly what happens inside each round? This tool runs a pure-TypeScript implementation of FIPS 197 in your browser, with CBC, CTR, and ECB modes, PKCS#7 padding, and a round-by-round state visualization that shows SubBytes, ShiftRows, MixColumns, and AddRoundKey at every step. No data leaves your device. Pick a key size, paste a key, and the ciphertext updates as you type.
What this tool does
- Encrypt and decrypt with AES-128 (10 rounds), AES-192 (12 rounds), or AES-256 (14 rounds) in CBC, CTR, or ECB mode using a pure-TypeScript FIPS 197 implementation
- Visualize the 4x4 byte state after every SubBytes, ShiftRows, MixColumns, and AddRoundKey operation for the first 16-byte block, so you can trace the diffusion step by step
- Accept keys in hex or text format, with strict byte-length validation (16, 24, or 32 bytes depending on key size)
- Auto-generate a random 16-byte IV for CBC and CTR, or let you paste a specific IV in hex for decryption
- Output ciphertext as hex or Base64, with PKCS#7 padding handled automatically for CBC and ECB
- Run entirely client-side: plaintext, keys, and ciphertext never touch a server
How this tool works
The tool uses a pure-TypeScript AES implementation that follows FIPS 197 directly. Key expansion produces 11, 13, or 15 round keys (for 128, 192, or 256-bit keys) using the Rijndael key schedule with RotWord, SubWord, and Rcon. Each encryption round applies SubBytes (S-box lookup), ShiftRows (left rotation per row), MixColumns (Galois field multiplication in GF(2^8)), and AddRoundKey (XOR with the round key). The final round omits MixColumns.
For CBC mode, the tool pads the plaintext with PKCS#7 to a multiple of 16 bytes, generates a random 16-byte IV, XORs each block with the previous ciphertext block (or the IV for the first block), then encrypts. CTR mode turns AES into a stream cipher by encrypting successive counter values and XORing the keystream with the plaintext, so no padding is needed.
The round visualization panel shows the 4x4 byte state as a hex grid after each operation. For AES-128 you see 41 states (initial AddRoundKey plus 10 rounds of 4 operations plus the final round). For AES-256 you see 57 states. This is the same data structure that FIPS 197 Figure 5 illustrates for the 128-bit key example.
The tool validates key lengths strictly. AES-128 requires exactly 16 bytes (32 hex characters). AES-192 requires 24 bytes. AES-256 requires 32 bytes. If your key does not match, the tool shows an error with the expected length.
How AES works (FIPS 197)
AES (Advanced Encryption Standard) is specified in FIPS 197, originally published in November 2001 and updated in May 2023 with editorial improvements. NIST selected the Rijndael algorithm, designed by Joan Daemen and Vincent Rijmen, from a public competition that began in 1997. AES processes 128-bit blocks with key lengths of 128, 192, or 256 bits, performing 10, 12, or 14 rounds respectively.
Each round applies four transformations over the Galois field GF(2^8) with the irreducible polynomial x^8 + x^4 + x^3 + x + 1. SubBytes replaces each byte using an S-box constructed from multiplicative inversion and an affine transformation. ShiftRows cyclically shifts the rows of the state matrix. MixColumns treats each column as a polynomial and multiplies it by a fixed polynomial. AddRoundKey XORs the state with the round key derived from the key schedule.
CBC mode is specified in NIST SP 800-38A and chains blocks by XORing each plaintext block with the previous ciphertext block. CTR mode, also in SP 800-38A, encrypts a counter to produce a keystream. ECB mode encrypts each block independently and leaks patterns; it is included here for education only.
For authenticated encryption, use AES-GCM (SP 800-38D), which combines CTR mode with a GHASH authentication tag. Our Block Cipher tool provides AES-GCM via the Web Crypto API. This pure-TS tool focuses on the educational round-by-round view that GCM implementations hide behind hardware acceleration.
How to use this tool
- Select a key size: AES-128 (10 rounds), AES-192 (12 rounds), or AES-256 (14 rounds). AES-256 is recommended for new encryption
- Choose a mode: CBC (recommended, requires IV), CTR (stream mode, requires IV), or ECB (insecure, education only)
- Enter your key in the Key field. Switch between Hex and Text format. The tool validates the key length matches the selected key size (16, 24, or 32 bytes)
- For CBC and CTR, leave auto-generate IV enabled for encryption. For decryption, paste the IV in hex that was used during encryption
- Type or paste your plaintext (for encryption) or ciphertext in hex/Base64 (for decryption) in the main input area
- Select output format: Hex or Base64. For encryption, the generated IV is displayed so you can copy it for decryption
- Expand the round-by-round state panel to see the 4x4 byte grid after each SubBytes, ShiftRows, MixColumns, and AddRoundKey operation
- Click Swap encrypt/decrypt to reverse the operation
Real-world examples
Encrypting a message with AES-128-CBC
Input: `Meet at dawn` with key `0123456789abcdef0123456789abcdef` (hex, 16 bytes). The tool generates a random 16-byte IV, pads the 12-byte plaintext to 16 bytes with PKCS#7 (4 bytes of 0x04), XORs with the IV, and encrypts through 10 rounds. The output is 16 bytes of ciphertext in hex. The displayed IV must be saved alongside the ciphertext for decryption.
Tracing the AES-128 state through round 1
With the same input, expand the round visualization. Round 0 shows the initial AddRoundKey (plaintext XORed with the first round key). Round 1 SubBytes shows each byte replaced by its S-box entry. ShiftRows shows row 1 shifted left by 1, row 2 by 2, row 3 by 3. MixColumns shows the diffusion within each column. AddRoundKey shows the result XORed with round key 1. This matches the FIPS 197 Appendix B example trace.
Why ECB leaks patterns
Encrypt a 48-byte plaintext of repeating 16-byte blocks (e.g. `AAAAAAAAAAAAAAAA` repeated 3 times) with ECB. The ciphertext will show three identical 16-byte blocks, revealing the repetition. Switch to CBC with the same key and the three ciphertext blocks will be completely different because each block is XORed with the previous ciphertext. This is why ECB is prohibited for real data.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| AES-128-CBC | 10 rounds, 128-bit key, software | Legacy systems, requires separate MAC |
| AES-256-CBC | 14 rounds, 256-bit key, software | High-security applications without hardware AES |
| AES-128-CTR | 10 rounds, stream mode, no padding | Stream encryption, parallelizable |
| AES-128-GCM | 10 rounds + GHASH, authenticated | TLS 1.3, VPNs, APIs (see Block Cipher tool) |
| AES-128-ECB | 10 rounds, no IV, no diffusion | Education only, leaks patterns |
Limitations or considerations
This is a pure-TypeScript implementation for education. It is slower than hardware-accelerated AES (AES-NI on x86, ARM Cryptography Extension) and has not been FIPS-validated. For production encryption, use the Block Cipher tool which calls the Web Crypto API for hardware-accelerated AES-GCM.
ECB mode is included for education only. It encrypts each 16-byte block independently, so identical plaintext blocks produce identical ciphertext blocks, leaking structure. Never use ECB for real data.
This tool does not provide authenticated encryption. CBC and CTR are malleable: an attacker can flip bits in the ciphertext and predictably change the decrypted plaintext. For authenticated encryption, use AES-GCM via the Block Cipher tool, which produces a 16-byte authentication tag that detects tampering.
This tool does not implement key derivation. If you need to derive a key from a password, use PBKDF2 or Argon2 first, then paste the derived key here.
Frequently asked questions
What is the difference between AES-128, AES-192, and AES-256?
The number refers to the key length in bits. AES-128 uses a 16-byte key and 10 rounds. AES-192 uses a 24-byte key and 12 rounds. AES-256 uses a 32-byte key and 14 rounds. More rounds mean more diffusion, but also more computation. AES-128 is sufficient for most applications; AES-256 is used for post-quantum preparation and government use.
Why does the round visualization show 41 states for AES-128?
AES-128 has 10 rounds. The initial AddRoundKey produces 1 state. Rounds 1 through 9 each produce 4 states (SubBytes, ShiftRows, MixColumns, AddRoundKey). The final round (round 10) produces 3 states (SubBytes, ShiftRows, AddRoundKey, with no MixColumns). Total: 1 + 9*4 + 3 = 40 states, plus the initial state shown for reference.
Is this implementation cryptographically correct?
Yes, the S-box, key schedule, and round functions follow FIPS 197 exactly. Test vectors from FIPS 197 Appendix B produce the expected ciphertext. However, this is a pure-TypeScript implementation for education, not a FIPS-validated module. For production, use the Web Crypto API via the Block Cipher tool.
What is PKCS#7 padding and why is it needed?
AES processes 16-byte blocks. If your plaintext is not a multiple of 16 bytes, CBC and ECB modes require padding. PKCS#7 appends N bytes each with the value N, where N is the number of padding bytes needed (1 to 16). On decryption, the last byte tells how many bytes to remove. CTR mode does not need padding because it is a stream mode.
Can I use this tool to encrypt files?
The tool processes text input. For file encryption, use a command-line tool like `openssl enc -aes-256-cbc` or a library. The same AES algorithm this tool implements is what file encryption tools use internally, but they handle large files with streaming and authenticated modes like GCM.
Conclusion
AES remains the symmetric encryption standard in 2026, specified in FIPS 197 and used in TLS 1.3, VPNs, file encryption, and countless APIs. This tool shows what happens inside each of the 10, 12, or 14 rounds, making the abstract FIPS 197 specification concrete. For production encryption with authentication, use the Block Cipher tool for AES-GCM. To derive a key from a password, use PBKDF2 or Argon2. For the asymmetric counterpart, see the RSA Encrypt / Decrypt tool.