AES Encrypt/Decrypt

Symmetric encryption with a passphrase

AES-256-GCM encrypts text so that only someone holding the same passphrase can read it back. AES is the cipher; GCM is the mode that bundles in authentication, so decryption fails loudly if a single byte of the ciphertext was altered. Because the same key both locks and unlocks, this is symmetric encryption. There is no public key here, so the passphrase is the entire secret.

How the passphrase becomes a key

A passphrase like correct horse is not 256 bits of key material on its own. A key-derivation function such as PBKDF2 stretches it, mixing in a random salt and running many iterations so that guessing is slow. The output is a 32-byte key the cipher can use. The salt and iteration count are stored alongside the ciphertext, usually not secret, because they are only useful with the passphrase.

Example

passphrase + random salt
  -> PBKDF2 (200000 rounds) -> 256-bit key
plaintext + key + random 12-byte nonce
  -> AES-GCM -> ciphertext + 16-byte auth tag

output = salt | nonce | ciphertext | tag  (then Base64)

The nonce rule that matters most

GCM demands a unique nonce (also called an IV) for every message encrypted under the same key. Reuse a nonce with the same key and GCM catastrophically leaks: an attacker can recover the keystream and even forge messages. That is why a fresh random nonce is generated per encryption and prepended to the output. Never hardcode it.

FAQ

Can I recover my text if I forget the passphrase? No. There is no backdoor. The passphrase is the only input that regenerates the key, so a lost passphrase means lost data.

Why does decryption say the data is corrupt? GCM verifies the auth tag first. A wrong passphrase, a truncated copy-paste, or a modified byte all fail the same check, which is the mode working as intended.

Is this strong enough for real secrets? AES-256-GCM is sound, but strength ultimately rests on passphrase quality. A short or common phrase can be brute-forced regardless of the cipher.