100% local and secure
Your data stays on your device and is never sent to our servers.
AES Encrypt & Decrypt
Protect text with AES-256-GCM using a key derived from your password and decrypt Bethemesh payloads in the browser.
- 100% local
- Instant
- Free
- No account
- Works offline
- Clipboard
Data not sent
AES settings
AES-256-GCM with PBKDF2-SHA-256 (210,000 iterations), random salt and IV.
Result
Why use this tool?
Encrypt or decrypt text with AES-256-GCM without sending the content or password to a server.
Smart processing
Generate or verify sensitive data with clear and immediate controls.
Supported formats
Strings, keys, hashes, and technical formats depending on the security function.
Save time
Get a clean, ready-to-use result in seconds without installing software or configuring a complex workflow.
Fonctionnement
How does this tool work?
The tool derives a 256-bit AES key from the password with PBKDF2-SHA-256 and a random salt. AES-GCM then encrypts the text using a random IV while authenticating the ciphertext. Version, salt, IV and encrypted bytes are packaged into a portable text value.
Use cases
Protect a sensitive note
Encrypt text locally before storing it or sending it through another channel.
Decrypt a Bethemesh payload
Recover the original text using the encrypted payload and the same password.
Compose a workflow
Chain encryption with local encoding, transformation or export steps.
Guide
How to use this tool
- 1
Choose the operation
Select encryption or decryption.
- 2
Add content and password
Enter the text or payload and the matching password.
- 3
Run locally
Copy the encrypted payload or decrypted text.
Examples
Encrypted text
Input
Hello + passwordResult
bm-aes1.…Tips and best practices
- Use a long, unique password.
- Keep the password separate from the encrypted payload.
- A wrong password or modified payload causes AES-GCM authentication to fail.
Frequently asked questions
Why AES-GCM?
AES-GCM provides both confidentiality and authentication of the encrypted data.
Is the password uploaded?
No. Key derivation and encryption run locally with Web Crypto.
Can I decrypt AES from another tool?
This tool decrypts the bm-aes1 format generated by Bethemesh because key derivation and packaging parameters must match exactly.
Was this tool useful?
Read next
GuideBest practicesBeginner
Hashes, integrity and fingerprint comparison: what a hash can really prove
Distinguish hashing from encryption and encoding, understand SHA-256 and SHA-3, collisions and the limits of a hash without authentication.
29 August 20262 minRead
GuideBest practicesBeginner
Content Security Policy (CSP): reduce XSS risks and unwanted loads
Learn how to introduce a CSP progressively, understand its main directives, Report-Only mode, nonces and common mistakes.
29 August 20261 minRead
GuideBest practicesBeginner
HTTP security headers: which ones to enable and why
Understand HSTS, CSP, X-Content-Type-Options, Referrer-Policy and Permissions-Policy and how to verify the headers actually returned.
29 August 20261 minRead
GuideBest practicesBeginner
JWT: understand structure, signature, expiration and common mistakes
Learn what a JWT contains, why decoding is not verification, how claims such as exp, nbf, iss and aud work, and common security mistakes.
29 August 20261 minRead
Recommended workflow
Continue your processing
Discover tools that naturally fit before, after, or alongside this one.
Complementary tools
Security & privacy
X.509 Certificate & CSR Inspector
Inspect an X.509 certificate or CSR in PEM format locally.
100% localNew
Use this toolSecurity & privacy
CSP generator
Create a Content Security Policy to strengthen your website security.
100% local
Use this toolSecurity & privacy
Security headers generator
Generate HTTP security headers for the protections you want to enable on your site.
100% local
Use this tool