FAQ
AES-CBC or AES-GCM?
Prefer GCM: it is authenticated encryption and detects tampering. CBC is more widely compatible but provides no integrity, so it needs a separate MAC.
What is the IV and why must it be unique?
The IV is the initialisation vector. Reusing one under the same key weakens CBC and outright breaks GCM security, so every encryption should use a fresh random value.
Can I decrypt without the key?
No. AES is symmetric: the same key and IV used to encrypt are required, and there is no recovery path.
About this tool
The four options do not share an implementation: AES-128-CBC, AES-256-CBC and AES-GCM use the browser's native Web Crypto, while DES is a pure-JavaScript implementation inside the page (Web Crypto dropped DES long ago) and exists only for legacy interoperability.
How the key and IV are interpreted is the usual source of mistakes. The rule: if the value is pure hexadecimal, of even length and exactly the required size, it is read as bytes; otherwise it is treated as UTF-8 text and padded or truncated to the required length, with a note in the status bar. Sizes are: AES-128 key 16 bytes, AES-256 key 32, IV 16; AES-GCM uses a fixed 12-byte IV; DES takes an 8-byte key and an 8-byte IV. A hex-looking key one digit short used to be silently turned into a different key by the ASCII fallback - it now raises an error instead.
CBC provides no integrity: flipping a ciphertext byte usually yields garbage rather than an error, and occasionally even decrypts cleanly when the padding happens to be valid. GCM is authenticated encryption with a 16-byte tag appended, so a single wrong byte fails loudly - prefer it for new work. The trade-off is that GCM is strict about IVs: reusing one under the same key leaks the XOR of the plaintexts and breaks authentication.
Output can be hex or Base64. On decryption the format is inferred: pure hex of even length is read as hex, everything else as Base64. That preference means a Base64 ciphertext made only of 0-9a-f with even length would be misread as hex - rare, but if a decryption fails, re-encrypt with the other output format and try again.
DES is nominally an 8-byte key, but the low bit of each byte is a parity bit, leaving 56 bits of real strength - brute-forceable in hours on ordinary hardware. It is here for compatibility, nothing else.
All operations run locally and the key never leaves the device, which also means there is no way to recover the key or IV once the tab is closed.