AES-GCM encryption
ciphertext and authentication tag = AES-GCM(key, IV, plaintext, additional data)
AES Encrypt & Decrypt
Protect text with AES-256-GCM and a key derived from your password (PBKDF2-SHA-256, 600,000 iterations), then decrypt it with the same password. Nothing is sent anywhere.
- Clipboard
Data not sent
AES-256-GCM, key derived from the password with PBKDF2-SHA-256 (600,000 iterations), random salt and IV for every encryption. Without the password, the text cannot be recovered.
Result
Was this tool useful?
How does this tool work?
This tool encrypts text with a password using AES-256-GCM and decrypts it with that same password, entirely in your browser. Use it to protect a note, a credential or a message before storing it or sending it over an untrusted channel, without installing any software.
A password is not an AES key: the tool derives a 256-bit key from it with PBKDF2-SHA-256 (RFC 8018) over 600,000 iterations, the level recommended by the OWASP Password Storage Cheat Sheet, and a random 16-byte salt. The UTF-8 text is then encrypted with AES-256-GCM (NIST SP 800-38D) using a random 12-byte IV, drawn fresh for every encryption. Encrypting the same text twice with the same password therefore gives two different results, which is normal and desirable. All of these operations go through the browser's Web Crypto API.
GCM is an authenticated encryption mode: it appends a 128-bit tag to the ciphertext that detects any modification. When decrypting, a wrong password or a single altered character makes that check fail, and the tool shows a clear error instead of garbled text. The output is a compact string bm-aes2.<salt>.<iv>.<ciphertext>, each part encoded in Base64URL: it only contains letters, digits, "-", "_" and dots, and pastes safely into an email or a ticket. This format is specific to Bethemesh; older bm-aes1 values, derived with 210,000 iterations, can still be decrypted.
How to use this tool
Choose the operation
Select "Encrypt" to protect a text or "Decrypt" to read back a bm-aes2 or bm-aes1 value.
Enter the text and password
Paste or import the text to encrypt, or the encrypted value, then type the password in the masked field.
Run it and get the result
Run the operation: the encrypted or decrypted text appears in the result panel, ready to copy or export as a text file.
AES-GCM encryption
Use cases
Send a credential by email or chat
Encrypt a service password or an access key before emailing it, then share the decryption password over another channel, such as a phone call or a text message.
Keep a confidential note in an unencrypted tool
Store sensitive information in a ticket, a wiki or a shared note as a bm-aes2 value: only people who know the password can read it back.
Check that an encrypted message was not altered
Thanks to GCM authentication, ciphertext that was truncated or edited will not decrypt: the error tells you the value you received is not the original or the password is wrong.
Examples
Encrypt and decrypt a message
Input
Operation: Encrypt (AES-256-GCM); Text: Bonjour; Password: exemple-local; then Decrypt with the same passwordResult
Result: bm-aes2.<salt Base64URL>.<IV Base64URL>.<ciphertext Base64URL> (different on each run); Decrypt with the same password: BonjourTips and best practices
- Security rests entirely on the password: 600,000 iterations slow down a dictionary attack, but they will not save "sunshine2024". Use a passphrase of several words or a long random password.
- Never send the password in the same message as the encrypted value: a single breach of that channel would then expose everything.
- There is no recovery: without the exact password (case and spaces included), the text is lost. Keep it in a password manager.
Sources and references
- NIST, FIPS 197 — Advanced Encryption Standard (AES) (opens in a new tab)Page in English
- K. Moriarty, B. Kaliski, A. Rusch, RFC 8018 — PKCS #5: Password-Based Cryptography Specification Version 2.1 (opens in a new tab), RFC Editor, 2017Page in English
Frequently asked questions
Is AES-256 still secure in 2026?
Yes. No practical attack breaks AES-256: the only realistic path is guessing the password the key is derived from. Even against a future quantum computer, Grover's algorithm would only reduce its strength to about 128 bits, which remains out of reach.
What is the difference between AES-GCM and AES-CBC?
CBC only encrypts: modified ciphertext silently decrypts into corrupted data, and the mode is exposed to padding oracle attacks unless it is combined with an HMAC. GCM encrypts and authenticates in one operation, so any tampering is detected. It is the mode used by TLS 1.3 and recommended for new designs.
Why does the output change every time I encrypt?
Each encryption draws a new 16-byte salt and a new 12-byte IV. This is essential with GCM: reusing an IV with the same key would leak information about the texts and allow forged messages. Both outputs still decrypt with the same password.
Can I decrypt the value with OpenSSL or another website?
Not directly. Decryption requires knowing the exact derivation (PBKDF2-SHA-256, iteration count, key length) and the order of the parts, which are specific to the bm-aes2 format. Conversely, the tool does not decrypt other programs' formats, such as the Salted__ output of openssl enc.
What does the decryption error mean?
It means GCM authentication failed: either the password differs from the one used to encrypt, or the value was truncated or modified, for example by an incomplete copy-paste. The tool cannot tell these two cases apart, precisely because it reveals nothing without the right key.
Can I encrypt files with this tool?
The tool is designed for text. To encrypt files, archives or backups, use a dedicated tool such as age, GPG or an encrypted container, which handle large volumes, public keys and file metadata.
Related tools
Keep going with these tools
Tools similar or complementary to this one.
Similar tools
Generate strong random passwords from 8 to 128 characters, with the entropy shown.
Security & privacyFeaturedUse this tool
Check how strong a password is: entropy, weak patterns, estimated time to crack and advice.
Security & privacyFeaturedUse this tool
Derive a salted PBKDF2-SHA-256 or SHA-512 password hash, or verify a password against an encoded value.
Security & privacyUse this tool
Read next
GuideBest practicesIntermediate
Encryption, hashing and HMAC: understand the differences
Learn when to use encryption, hashing, HMAC or key derivation for confidentiality, integrity, authentication and password handling.
23 September 20263 min
GuideBest practicesBeginner
Hashes, integrity and fingerprint comparison: what a hash can really prove
Distinguish hashing from encryption and encoding, understand SHA-256 and SHA-3, collisions and the limits of a hash without authentication.
29 August 20262 min
GuideBest practicesBeginner
Passwords: generation, strength and useful policies
Understand why length and uniqueness matter, how password managers, MFA and passkeys complement passwords, and how servers should store them.
29 August 20262 min
GuideBest practicesBeginner
Content Security Policy (CSP): reduce XSS risks and unwanted loads
Learn how to introduce a CSP progressively, understand its main directives, Report-Only mode, nonces and common mistakes.
29 August 20261 min