Introduction
Need to encrypt a file payload with AES-GCM or decrypt a legacy 3DES ciphertext from an old database export? This tool runs AES-128, AES-256, DES, and Triple DES directly in your browser using the Web Crypto API for AES and a pure JavaScript DES implementation. No data leaves your device. Select an algorithm, pick a mode, paste your key, and the result updates as you type. AES-GCM is the default because it provides authenticated encryption. DES and 3DES are included for legacy decryption and education, not for new encryption.
What this tool does
- Encrypt and decrypt with AES-128 and AES-256 in GCM (authenticated) or CBC mode, using the browser's native Web Crypto API (crypto.subtle)
- Encrypt and decrypt with DES (56-bit key) and Triple DES (112 or 168-bit key) in CBC or ECB mode, using a pure TypeScript DES implementation
- Accept keys in text or hexadecimal format, with automatic byte-length validation per algorithm
- Auto-generate a random IV for each encryption, or let you paste a specific IV in hex for decryption
- Output ciphertext as hex or Base64, with PKCS#7 padding handled automatically
- Run entirely client-side: plaintext, keys, and ciphertext never touch a server
How this tool works
AES encryption uses the browser's built-in `crypto.subtle` API, which provides hardware-accelerated AES through the native `SubtleCrypto.encrypt()` and `SubtleCrypto.decrypt()` methods. When you select AES-GCM, the tool generates a 12-byte random IV, passes it with your key to `importKey()`, and calls `encrypt()` with the `AES-GCM` algorithm identifier. GCM produces ciphertext plus a 16-byte authentication tag appended at the end. On decryption, the tag is verified automatically. If the key or ciphertext is wrong, the API throws an error.
For AES-CBC, the tool generates a 16-byte IV and calls the same API with `AES-CBC`. CBC does not provide authentication, so the tool displays a warning recommending GCM. The Web Crypto API handles PKCS#7 padding internally for both modes.
DES and Triple DES run through a TypeScript implementation of FIPS 46-3. The code performs the 16-round Feistel network with the standard S-boxes, permutation tables, and key schedule. Triple DES uses the EDE scheme: encrypt with K1, decrypt with K2, encrypt with K3. For 2-key 3DES (16-byte key), K3 equals K1. The tool applies PKCS#7 padding before encryption and removes it after decryption.
The tool validates key lengths strictly. AES-128 requires exactly 16 bytes. AES-256 requires 32 bytes. DES requires 8 bytes (64 bits including 8 parity bits, 56 effective). 3DES accepts 16 or 24 bytes. If your key does not match, the tool shows an error message with the expected length.
How AES and DES block ciphers work
AES (Advanced Encryption Standard) is specified in FIPS 197, originally published in November 2001 and updated in May 2023 with editorial improvements but no technical changes. NIST selected the Rijndael algorithm, designed by Joan Daemen and Vincent Rijmen, from a public competition that began in 1997. AES processes 128-bit blocks with key lengths of 128, 192, or 256 bits, performing 10, 12, or 14 rounds respectively. Each round applies SubBytes (S-box substitution), ShiftRows, MixColumns, and AddRoundKey operations over the Galois field GF(2^8).
AES-GCM (Galois/Counter Mode) is specified in NIST SP 800-38D and is the default mode for TLS 1.3. GCM combines CTR mode encryption with GHASH authentication, producing both ciphertext and a 16-byte tag that detects tampering. AES-CBC is specified in NIST SP 800-38A and chains blocks by XORing each plaintext block with the previous ciphertext block before encryption.
DES (Data Encryption Standard) was published as FIPS 46 in 1977, based on the IBM-designed Lucifer cipher with modifications by the NSA. DES uses a 56-bit key and 64-bit blocks across 16 rounds. The 56-bit key space (2^56 possibilities) was brute-forced by the EFF Deep Crack machine in 1998 in 56 hours. Triple DES (TDEA) applies DES three times with two or three keys, providing 112 or 168 bits of security. NIST SP 800-131A Rev. 3 (October 2024 draft) disallowed TDEA for encryption as of 2024, classifying it as legacy-only for decryption. The same draft also proposes retiring ECB mode for confidentiality.
For any new encryption, AES-GCM with a 256-bit key is the standard choice. It is hardware-accelerated on modern x86 and ARM processors through AES-NI instructions, making it faster than DES in software despite having a larger block size and more rounds.
How to use this tool
- Select an algorithm: AES-128, AES-256, DES, or 3DES. AES is recommended for all new encryption
- Choose a mode: GCM (authenticated, recommended) or CBC for AES. CBC or ECB for DES/3DES
- Enter your key in the Key field. Switch between Text and Hex format. The tool validates the key length matches the selected algorithm (16 bytes for AES-128, 32 for AES-256, 8 for DES, 16 or 24 for 3DES)
- For modes requiring an IV, leave auto-generate enabled for encryption. For decryption, paste the IV in hex that was used during encryption
- Type or paste your plaintext (for encryption) or ciphertext in hex/Base64 (for decryption) in the main input area
- Select output format: Hex or Base64. For encryption, the generated IV is displayed below the IV settings so you can copy it for decryption
- Click Swap encrypt/decrypt to reverse the operation and move output to input
Real-world examples
Encrypting a configuration string with AES-256-GCM
Input: `database_password=hunter2` with key `0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef` (hex, 32 bytes). The tool generates a random 12-byte IV, encrypts the 24-byte plaintext with AES-256-GCM, and outputs 40 bytes of ciphertext plus a 16-byte authentication tag in hex. The displayed IV (e.g. `a1b2c3d4e5f6a7b8c9d0e1f2`) must be saved alongside the ciphertext for decryption.
Decrypting a legacy 3DES-CBC ciphertext from an old database
A legacy system stored encrypted fields using 3DES-CBC with a 24-byte key. Set algorithm to 3DES, mode to CBC, key format to hex, and paste the 24-byte key. Disable auto-IV and paste the 8-byte IV in hex. Switch to Decrypt mode, set output format to match the ciphertext encoding (hex or Base64), and paste the ciphertext. The tool runs the three-pass EDE decryption, removes PKCS#7 padding, and displays the recovered plaintext. NIST disallowed 3DES for new encryption in 2024, so migrate to AES after recovering legacy data.
Verifying AES-GCM authentication tag failure
Encrypt a message with AES-128-GCM and copy the hex ciphertext. Flip one byte in the middle of the ciphertext, then try to decrypt with the same key and IV. The Web Crypto API will throw a decryption error because the GCM authentication tag no longer matches. This demonstrates why GCM is preferred over CBC: CBC will happily produce garbage plaintext without detecting the modification, while GCM fails loudly.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| AES-128-GCM | 10 rounds, 128-bit key, hardware-accelerated | TLS 1.3, VPNs, file encryption, APIs |
| AES-256-GCM | 14 rounds, 256-bit key, hardware-accelerated | Government, high-security applications, post-quantum preparation |
| AES-128-CBC | 10 rounds, no authentication | Legacy systems, requires separate MAC |
| 3DES (TDEA) | 48 rounds total, 64-bit blocks, software-only | Legacy decryption only, disallowed for new encryption since 2024 |
| DES | 16 rounds, 56-bit key, 64-bit blocks | Education only, broken since 1998 |
Limitations or considerations
AES runs through the Web Crypto API, which requires a secure context (HTTPS or localhost). The tool will not work over plain HTTP in production. The Web Crypto API does not support DES or 3DES, so those algorithms use a pure TypeScript implementation that is slower than native code and has not been FIPS-validated.
NIST SP 800-131A Rev. 3 (October 2024) disallowed TDEA for encryption as of 2024. DES with its 56-bit key has been broken since the EFF Deep Crack machine in 1998. ECB mode is insecure because identical plaintext blocks produce identical ciphertext blocks, leaking patterns. The tool includes ECB only for DES/3DES legacy compatibility.
This tool does not implement key derivation. If you need to derive a key from a password, use PBKDF2 or Argon2 first, then paste the derived key here. For hashing data to verify integrity, use our SHA-256 Hash Generator.
Frequently asked questions
What is the difference between AES-GCM and AES-CBC?
GCM (Galois/Counter Mode) provides both encryption and authentication. It produces a 16-byte tag that verifies the ciphertext was not modified. CBC (Cipher Block Chaining) provides encryption only. If you use CBC, you need a separate HMAC to detect tampering. GCM is the default in TLS 1.3 and is recommended for all new applications.
Is 3DES still safe to use?
No. NIST SP 800-131A Rev. 3 (October 2024) disallowed TDEA (3DES) for encryption as of 2024. It may only be used for decrypting legacy data. 3DES has a 64-bit block size, which makes it vulnerable to birthday attacks (Sweet32) when encrypting large amounts of data with the same key. Migrate to AES-128 or AES-256.
Why does the tool require an exact key length?
AES-128 requires exactly 16 bytes (128 bits). AES-256 requires 32 bytes. DES requires 8 bytes. The algorithms are defined with fixed key sizes. If you provide a key of the wrong length, the cipher will produce incorrect results or throw an error. Use a key derivation function like PBKDF2 or Argon2 to convert a password into a key of the correct length.
What is the IV and why is it needed?
The IV (Initialization Vector) is a random value that makes each encryption unique, even if the same plaintext and key are used. GCM uses a 12-byte IV. CBC uses a 16-byte IV. The IV is not secret and should be stored alongside the ciphertext. Without the correct IV, decryption will fail or produce garbage.
Can I use this tool to encrypt files?
The tool processes text input. For file encryption, use a command-line tool like `gpg` or `openssl enc`, or a library like `crypto.subtle` in JavaScript. The same AES-GCM algorithm this tool uses is what file encryption tools use internally.
Conclusion
AES-GCM is the standard for symmetric encryption in 2026, specified in FIPS 197 and NIST SP 800-38D, and accelerated by hardware on modern processors. This tool makes it accessible directly in the browser. DES and 3DES are included for legacy decryption only, as NIST disallowed them for new encryption. For password-based encryption, derive a key with our PBKDF2 / Argon2 tool first. To verify data integrity, use the SHA-256 Hash Generator. For stream cipher education, see the RC4 Stream Cipher tool.