# Encrypt & Decrypt Text Online - AES-GCM, AES-CBC, RSA-OAEP and HMAC

> Free online text encryption: AES-256-GCM or CBC with a password (PBKDF2, OpenSSL-compatible output), raw key + IV mode, RSA-OAEP and HMAC signatures.

- URL: https://qilingtools.com/en/encrypt
- Category: Developer Tools (https://qilingtools.com/en/dev)
- Tags: [Privacy & Security](https://qilingtools.com/en/tags/privacy), [Developer](https://qilingtools.com/en/tags/dev), [Encoding](https://qilingtools.com/en/tags/encode)
- Last updated: 2026-10-26
- Price: Free, no sign-up
- Privacy: Runs locally in the browser; files are never uploaded

Whether you need to send a password or config snippet securely or debug an AES, RSA or HMAC integration, this tool does it in your browser with the built-in WebCrypto API, and nothing is uploaded. Password mode uses AES-256-GCM by default, deriving the key with PBKDF2-SHA256 (600,000 iterations by default, adjustable) and a fresh random salt and IV every time. The algorithm, iteration count, salt and IV are stored in the header of the Base64 ciphertext, so decrypting only needs the password, and GCM also detects tampering. Switch to the OpenSSL-compatible format to produce ciphertext that openssl enc -d -aes-256-cbc -pbkdf2 decrypts directly, and vice versa. Raw-key mode takes a hex key and IV for AES-CBC (PKCS#7) or AES-GCM with Base64 or hex output, matching openssl -K -iv, CryptoJS, Node.js crypto, Java and Python, with ready-made code snippets. The RSA tab generates 2048, 3072 or 4096-bit RSA-OAEP key pairs as PEM, encrypts with a pasted public key and decrypts with the private key, using SHA-256 or SHA-1 for OpenSSL and Java compatibility. The HMAC tab computes HMAC-SHA256, SHA-512 and more in real time with text, hex or Base64 keys.

## How to use

1. Choose password, raw key, RSA or HMAC
2. Enter the password or key, pick encrypt or decrypt and paste the text or ciphertext
3. Run it and copy the result, or feed the result back in to verify the round trip

## Features

- AES-256-GCM / AES-CBC password encryption with adjustable PBKDF2-SHA256
- Self-describing ciphertext: only the password is needed to decrypt
- OpenSSL enc -pbkdf2 compatible format
- Raw hex key + IV mode, interoperable with CryptoJS, Node and OpenSSL
- RSA-OAEP key pair generation (PEM) and encryption
- HMAC-SHA1/256/384/512 with hex and Base64 output
- Local WebCrypto — passwords and keys never leave the browser

## FAQ

### Why is the ciphertext different every time?

Each encryption uses a new random salt and IV, so the same text and password produce a different ciphertext every time. This stops anyone from learning something by comparing ciphertexts. The salt, IV, algorithm and iteration count are stored in the ciphertext header, so the correct password is all you need to decrypt.

### Should I use AES-GCM or AES-CBC?

Use AES-GCM whenever you can. It is authenticated encryption, so a wrong password or modified ciphertext fails to decrypt. AES-CBC provides confidentiality only, has no integrity check and can occasionally produce garbage instead of an error with a wrong password — use it only to interoperate with legacy systems, the OpenSSL command line or CryptoJS defaults.

### Does it work with OpenSSL, CryptoJS and backend code?

Yes. In password mode choose the OpenSSL-compatible format and decrypt with openssl enc -d -aes-256-cbc -pbkdf2 -iter N -a. Raw-key mode matches openssl enc -K -iv, CryptoJS.AES.encrypt with a hex key and iv, and Node.js createCipheriv, and the page shows sample code. CryptoJS with a plain string passphrase uses a legacy MD5-based key derivation, which this tool intentionally does not support.

### Are my passwords and keys uploaded or stored?

No. All encryption and decryption runs locally through the browser’s WebCrypto API. Passwords, keys, plaintext and ciphertext are never sent to a server or stored, and are gone when you close the page — so keep your password and private key safe, because lost keys cannot be recovered.

## Related tools

- [JSON Formatter](https://qilingtools.com/en/json): Free online JSON formatter: beautify or minify, validate with the exact line and column of any error, browse a collapsible tree, sort keys and escape strings.
- [Base64 Encode/Decode](https://qilingtools.com/en/base64): Free online Base64 encoder and decoder: UTF-8 safe, optional URL-safe variant, convert text to Base64 and back in real time. Processed locally, never uploaded.
- [URL Encode/Decode](https://qilingtools.com/en/url-encode): Free online URL encoder and decoder with encodeURIComponent and encodeURI modes. Escapes Chinese, spaces and special characters. Real-time and local, no upload.
- [JWT Decoder](https://qilingtools.com/en/jwt): Free online JWT decoder: decode the header and payload of a JSON Web Token, show expiry and issued-at times, all locally without uploading the token.
- [Timestamp Converter](https://qilingtools.com/en/timestamp): Free online Unix timestamp converter: convert timestamps and dates, auto-detect seconds or milliseconds, and show local, UTC, ISO 8601 and relative time.
- [Hash / Checksum](https://qilingtools.com/en/hash): Free online hash calculator: SHA-1, SHA-256, SHA-384 and SHA-512 of text or any file through the browser crypto API. Files never leave your device.
- [UUID Generator](https://qilingtools.com/en/uuid): Free online UUID generator: create RFC 4122 UUID v4 in bulk with a cryptographic RNG. Options for uppercase, no hyphens and braces, with one-click copy.
- [Base Converter](https://qilingtools.com/en/base-convert): Free online number base converter: convert between binary, octal, decimal, hexadecimal and any base 2–36. Uses BigInt for huge integers, computed locally.