AES Encryption and Decryption Online: CBC, ECB, Keys, and IVs

Summary：Use AES-128, AES-192, or AES-256 with CBC or ECB in your browser. Check UTF-8 key lengths, IV requirements, and hex or Base64 ciphertext encoding.

When integrating an API or debugging encryption settings, an independent ciphertext calculation can help. Xian's Tools provides two AES tools:

AES Encryption and Decryption: specify key size, CBC or ECB mode, an IV, and ciphertext encoding for comparisons with Java, Python, Go, or Node.js implementations.
AES Passphrase Encryption: enter a passphrase and use the CryptoJS-compatible encryption format.

Both tools run in your browser. Your input and keys are not sent to a processing server.

Parameters for the standard AES tool

- Key Size：128、192 或 256；决定所需的密钥长度（以字节为单位）。

- Cipher Mode：CBC 或 ECB。CBC 使用 IV；ECB 不使用。

- Key：按 UTF-8 字节解释的文本。

- iv：仅在 CBC 模式下显示的文本。

- Encode Format：hex、base64 或 utf8。加密时，这是密文的输出编码；解密时，这是密文的输入编码。

该工具使用 PKCS#7 填充。Java 提供程序通常以 PKCS5Padding 这一名称公开等效的 AES 填充行为。

Required key lengths

UTF-8 密钥长度必须恰好为：

AES-128：16 字节，例如 16 个 ASCII 字母或数字。
AES-192：24 字节。
AES-256：32 字节。

许多常见中文字符在 UTF-8 中占三个字节，因此字符数与字节数不同。如果密钥长度不正确，该工具会报告所需的字节数，而不会对密钥进行填充或截断。

IV requirements

在 CBC 模式下，IV 必须为 16 个 UTF-8 字节。
将 IV 留空会使用 16 个零字节。这与输入十六个 ASCII 0 字符不同。

How to use it

1. Enter plaintext under Original Content, or ciphertext when decrypting.

2. Enter the Key and select the matching Key Size.

3. Select Cipher Mode and enter the IV for CBC if needed.

4. Choose Encode Format, usually base64 or hex.

5. Click Encrypt or Decrypt, then copy the result.

CBC and ECB compared

ECB encrypts each block independently. Identical plaintext blocks produce identical ciphertext blocks, exposing patterns. Use it only when a legacy integration requires it rather than choosing it for a new design.
CBC combines each plaintext block with the previous ciphertext block before encryption. An IV initializes the process. For actual message encryption, use a fresh unpredictable IV and transmit it with the ciphertext. CBC alone does not authenticate the message.

Hex and Base64 ciphertext

Both encodings represent binary ciphertext as printable text:

hex uses two characters per byte, from 0-9 and a-f.
base64 is roughly two-thirds the length of hex for larger inputs and is often used in JSON or HTTP payloads.

**To Upper Case** can be used for hex output. **Base64 is case-sensitive: changing its case changes the encoded bytes and can prevent decryption.** The utf8 option is generally unsuitable for ciphertext because arbitrary encrypted bytes are not necessarily valid UTF-8 text.

Troubleshooting mismatched results

**Mode**: CBC and ECB produce different results.
**Key size**: verify that both implementations use the same AES variant and key bytes.
**IV**: check for a zero IV, a random IV, or an IV prefixed to the ciphertext.
**Padding**: NoPadding or ZeroPadding will not match this tool's padding behavior.
**Encoding**: check hex versus Base64. A key displayed as hex or Base64 may need decoding elsewhere; this tool treats the Key field as UTF-8 text.
**Plaintext**: check for extra spaces, line breaks, and encoding differences.

The passphrase tool

AES Passphrase Encryption accepts input text and a Key used as a passphrase. Click Encrypt to obtain Base64 ciphertext.

The passphrase does not need the standard AES key length. CryptoJS derives a key and IV from the passphrase and a random salt.

The same input and passphrase usually produce different ciphertext on each encryption

Each result can still be decrypted using the same passphrase, because the salt changes.

Ciphertext commonly starts with U2FsdGVkX1, associated with the OpenSSL-style salted format used by CryptoJS.
The workflow matches CryptoJS.AES.encrypt(text, passphrase) with compatible settings.

This is useful for testing projects that use the same CryptoJS passphrase workflow. For comparisons with an implementation that accepts a raw AES key and IV, use the standard AES tool.

Notes for encryption testing

Use test keys when learning or debugging, and keep production keys protected.
Avoid pasting sensitive keys into websites you do not trust.
For new production systems, consider an authenticated mode such as AES-GCM and use an established library to generate the required random keys and IVs. This page's standard tool provides CBC and ECB, not GCM.