AES Online Encryption & Decryption: CBC

When you receive an ivBase64:cipherBase64 ciphertext during API debugging and need to check its fields, or when you want to encrypt a value without handing your key to a third-party website, a browser-local AES online encryption tool is the fastest option: neither the key nor the text ever leaves your device. We tested the complete encrypt → copy → decrypt flow in the browser before writing this guide. The guide walks through AES-CBC parameters and the ciphertext format, then shows the full encrypt, decrypt, and troubleshooting flow.

When to use an online AES tool

An online AES tool fits three situations:

• Quick debugging: verify an encryption parameter or decrypt a ciphertext returned by an API, then move on.
• Interoperability tests: confirm that your implementation and the tool can decrypt each other's output, which surfaces mismatches in mode, padding, or encoding.
• No sign-up, no uploads: the key and plaintext are processed only in your browser and never sent to a server.

Be clear about what it is not: this is not a key-management service and it is not a password storage scheme. Passwords should use dedicated hash algorithms, such as the ones compared in the MD5 vs SHA256 hash guide, not reversible encryption.

Encrypting in three steps

1. Open the AES online encryption & decryption tool and enter the text to encrypt in the "Plaintext / Ciphertext" field.
2. Enter a key. You can leave IV empty; the tool generates a random 16-byte IV and prepends its Base64 form to the output.
3. Click "Encrypt" to get a result in the ivBase64:cipherBase64 format, where the part before the colon is the IV and the part after it is the ciphertext.

The tool uses AES-CBC with PKCS7 padding and Base64 output. The key length follows the UTF-8 byte count of the input string: 16, 24, and 32 bytes map to AES-128, AES-192, and AES-256. Note that a Chinese key is measured in bytes, not characters — one character in UTF-8 can occupy three bytes.

Decrypting and reading the format

To decrypt, paste the full ivBase64:cipherBase64 value into the input; the tool splits the IV and ciphertext automatically. You can also paste the IV into the "IV (optional)" field.

Decryption failures almost always come from one of three causes:

Also keep in mind: Base64 is encoding, not encryption. The Base64 portion of the ciphertext uses the same representation as the Base64 encoder/decoder, but it is the AES key that actually protects the content. For more on the difference, read the Base64 encoding and decoding guide.

Frequently asked questions

Does it support AES-256-CBC?

Yes. Key length follows the input string byte count: 16, 24, and 32 bytes map to AES-128, AES-192, and AES-256. Encryption uses CBC mode with PKCS7 padding.

Why does decryption fail?

The usual causes are a mismatched key, a wrong IV, or incomplete ciphertext. When no IV is provided during encryption, a random one is generated and prepended as ivBase64 — decryption needs that same IV and key.

Is my data uploaded?

No. Encryption and decryption run entirely in your browser; the input and key never leave your device.

Try it with a real value

Take a real ciphertext from your API, keep the original value and key, then open the AES online encryption & decryption tool and try both directions. As long as mode, padding, key, and IV match, the two sides decrypt each other. For production key management, follow the AES definition in FIPS 197 and use a mature library from your language ecosystem.

References

[1] NIST FIPS 197 — AES standard: https://csrc.nist.gov/pubs/fips/197/final [2] RFC 2315 — PKCS#7 Cryptographic Message Syntax (padding): https://www.rfc-editor.org/rfc/rfc2315