Tools ยท Encryption playgrounds
AES playground
Encrypt and decrypt with AES-GCM, CBC and CTR, see the tag, flip one bit, and watch a reused nonce give a message away.
Nothing you type here leaves your browser. The keys and nonces are made by your browser's secure random number generator and are not stored.
This AES playground encrypts and decrypts with AES-GCM, AES-CBC or AES-CTR using the browser's own crypto, and it lets you break things on purpose. Flip a bit and watch GCM refuse while the other modes shrug. Reuse a nonce and see what leaks. Keys and nonces are random by default and never leave the page.
Using it
Type a message, pick a mode and press Run. The key and nonce are random by default, and you can paste your own hex values to reproduce a result. The ciphertext shows in hex. In GCM mode the 16-byte authentication tag is shown separately. The browser appends it to the ciphertext, and the tool splits it off so you can see it. To decrypt, switch the direction, paste the ciphertext in the message box (with the tag appended for GCM), and use the same key, nonce and associated data.
Three buttons teach the lesson that matters most.
- Flip one bit, then decrypt. This encrypts, changes one bit of the ciphertext, and tries to decrypt. In GCM the tag no longer matches and the browser refuses, releasing nothing. In CBC the first block decrypts to noise and the next block has one bit flipped. In CTR a single character of the message changes in a way an attacker can plan. Neither of those two modes notices.
- Show what nonce reuse does. This encrypts two different messages with the same key and counter, then shows how XORing the ciphertexts removes the key and leaves the XOR of the messages. A guess about one message gives away the other.
- Random key / Random. These make fresh values, so you can see the same message encrypt differently every time.
The three modes
| Mode | What it does | Needs | Notices tampering? |
|---|---|---|---|
| GCM | Counter-mode encryption plus a 128-bit tag over the ciphertext and associated data | A 96-bit nonce that is never reused with the same key | Yes: decryption fails |
| CBC | Each block is XORed with the previous ciphertext block before encryption; the message is padded to a whole number of blocks | An unpredictable 128-bit IV | No; and padding errors can be abused (padding-oracle attacks) |
| CTR | Encrypts a counter and XORs the result with the message, so it works as a stream cipher | A counter block that is never reused | No: flipping a ciphertext bit flips the same plaintext bit |
cipher.ink uses AES-256-GCM. The AES-GCM article explains the tag arithmetic with a worked example, and the OFB and CBC article covers what happens to an error under the older modes. For the structure inside AES itself, use the AES round explorer.
Why the browser does the work
The tool calls crypto.subtle, the Web Crypto API that every current browser provides. That code is native, constant-time and audited, whereas a JavaScript AES would be slower and might leak the key through timing. The only AES on this site that isn't Web Crypto is the teaching implementation in the round explorer and the ECB image demo, where Web Crypto has no ECB mode.
Common questions
Why is the GCM nonce only 12 bytes?
That's the length GCM handles most efficiently, because it's used directly as the start of the counter. Other lengths are allowed but get hashed first, which costs time and weakens the usual safety argument. If you pick nonces at random, 12 bytes is safe for roughly 232 messages under one key. After that, use a different key.
What is "associated data"?
It's information sent in the clear that must not be altered, such as a message header or a version number. GCM mixes it into the tag, so changing it makes decryption fail.
Why does CBC decryption sometimes fail with an error?
CBC pads the message so it fills whole 16-byte blocks. A wrong key or a changed last block produces invalid padding, and the browser reports it. In real systems, error messages that tell padding errors apart from other failures can leak data.
Is it safe to paste a real key here?
The page makes no network requests and stores nothing, and the site's Content-Security-Policy would block any request. Still, treat any key you've pasted into any web page as one you might retire.