Symmetric encryption (AES, SM4, DES)
Encrypt or decrypt text with AES (CBC, ECB, CTR, CFB, OFB or GCM), SM4, DES, Triple DES, Blowfish, RC2, RC5, RC6, RC4, Rabbit or XOR. The key is a separate input and is never saved with workflows.
Process locally
Files stay in this browser session. Closing or clearing releases them.
Add text
Type or paste the text to process
Adjust settings
Optional: Algorithm, Direction, Mode and more
Run
Processes in this browser; cancel at any time
About this tool
Encrypt or decrypt text with AES, SM4, DES, Triple DES and other symmetric ciphers. Use it to check an encrypted field that an API or a legacy system sends, to reproduce a value stored in a config file or database, or to compare your own code’s output with a known result when the key, IV, mode and padding all have to match.
AES works in CBC, ECB, CTR, CFB, OFB or GCM mode; SM4, DES, Triple DES, Blowfish, RC2, RC5 and RC6 in all of these except GCM; RC4, Rabbit and XOR use no mode. The key and IV are used exactly as entered, as text, hex or Base64, without deriving them from a password. Up to 1 MB is processed in your browser: text and key are not uploaded, and the key is never saved with workflows.
How to use it
- Type the text to encrypt, or the Base64 or hex ciphertext to decrypt, into “Text”, and the key into “Key (not saved with workflows)”. Use example fills in both.
- Choose the “Algorithm” and the “Direction”, then the “Mode” and “Padding” the other side uses.
- Enter the “IV”, and pick the “Key and IV format” (“Text (UTF-8)”, “Hex” or “Base64”) and the “Ciphertext format”.
- Select Run, preview the result and download it as encrypted.txt or decrypted.txt.
Formats and limits
- Input
- Text
- Output
- Plain text
- Size limit
- 1 MB
- Settings
- Algorithm; Direction (Encrypt, Decrypt); Mode (CBC, ECB, CTR, CFB, OFB, GCM); Padding (PKCS7, Zeros, None, ANSI X9.23, ISO 10126); IV; Key and IV format (Text, Hex, Base64); Ciphertext format (Base64, Hex)
- Privacy
- Text and keys stay in this browser session and are not uploaded. Keys are an input, so they are never saved with workflows or recipes.
- Price
- Free, no sign-up
Common questions
How do I choose AES-128, AES-192 or AES-256?
The key length decides it: 16, 24 or 32 bytes. With “Text (UTF-8)” an English letter or digit is one byte and a Chinese character three; in hex a 32-byte key is 64 digits. A key of any other length is rejected, not padded or cut.
What IV do I need?
16 bytes for AES, SM4 and RC6, 8 bytes for DES, Triple DES, Blowfish, RC2 and RC5, and usually 12 for GCM (8 to 64 are accepted). ECB, RC4 and XOR ignore the IV, and Rabbit takes none or 8 bytes, so clear the example value for Rabbit. The example IV is only for trying the tool: use a random IV and keep it with the ciphertext, because the result does not include it.
Why does decryption fail?
The key, IV, mode, padding and ciphertext format must all match the encryption. The tool checks the padding and requires the result to be valid UTF-8 text, so a wrong key usually ends in an error rather than garbled text. The chosen padding is also applied in CTR, CFB and OFB mode here; if the other side does not pad in those modes, set “Padding” to “None”.
Can it decrypt ciphertext that starts with U2FsdGVkX1?
No. That is OpenSSL’s “Salted__” format, produced when a library such as crypto-js derives the key and IV from a passphrase and a random salt. This tool uses the key and IV exactly as entered and does not derive them.
What is different about GCM?
GCM authenticates the data: a 16-byte tag is appended to the ciphertext, and decryption fails if the key, the IV or any byte of the ciphertext is wrong. It is available for AES only, does not pad, and takes no additional authenticated data (AAD).
Related tools
RSA and SM2 encryption and signatures
Encrypt, decrypt, sign or verify text with an RSA key (PEM: PKCS #1, PKCS #8, public key or certificate) or an SM2 key (hex or PEM). Keys stay in the browser and are never saved with workflows.
Caesar cipher and Morse code
Encrypt or decrypt with the Caesar cipher (any shift), ROT13, ROT47 or Atbash, or encode and decode international Morse code.
Key pair generator
Generate RSA, ECDSA (P-256, P-384, P-521), Ed25519 or SM2 key pairs as PEM in PKCS #8 or traditional form, for JWT, TLS or encryption tests.
CRC and checksums
CRC-8, CRC-16 (Modbus, CCITT, XMODEM and more), CRC-32, CRC-32C, Adler-32, BCC (XOR), LRC and 8-bit sum of hex bytes or text, shown in hex, decimal and binary.
Hash text (MD5, SHA, SM3)
MD5, SHA-1, SHA-2, SHA-3, Keccak, RIPEMD-128/160/256/320, SM3, BLAKE2 and BLAKE3 digests of text, hex or Base64 input, optionally line by line.
File checksums
MD5, SHA-1, SHA-256, SHA-512, SHA3-256, SM3, BLAKE3, CRC-32 or xxHash64 of up to 50 files of any type, read as a stream so large files work.