AES-GCM Raw Key Encrypt & Decrypt

Use AES-GCM directly for interoperability testing when you already have key bytes, instead of deriving a key from a passphrase.

Key format

Raw AES key

IV (hex)

Additional authenticated data (optional text)

Plaintext

Ciphertext + 128-bit tag (Base64)

ReadyChanging the key, IV, ciphertext, or AAD causes authenticated decryption to fail.

All cryptographic operations run locally in your browser. Keep private keys secret and use production key-management practices for real systems.

AES-GCM Raw Key: Key, IV, AAD & Tag Audit

Audit AES-GCM raw key length, IV size, AAD bytes, ciphertext tag capacity and common interoperability requirements.

Quick-win verification depth

Browser-local cryptographic utilities

preserves the established Web Crypto workflows while connecting token, key, KDF, encryption/signature, fingerprint and verification jobs. Inputs stay in your browser unless the page clearly states that a network request is required.

Protocol boundary

Correct primitive output does not certify a complete protocol, key-management system, parameter choice, endpoint, or production deployment. Match the source system exactly and use established application/security libraries for production authentication and storage.

Practical guide and verification

Use the tool first, then use these checks to interpret, verify and hand off the result without displacing the primary workflow.

Never reuse a nonce with the same AES-GCM key

GCM security depends critically on nonce uniqueness for a given key. Generate a fresh IV for each encryption unless a protocol defines a safe deterministic construction, and store or transmit the IV alongside the ciphertext so decryption can reproduce the authenticated operation.

Treat AAD as authenticated context, not encrypted data

Additional authenticated data is visible but protected against modification. The decrypting side must provide exactly the same AAD bytes. Record its encoding and meaning explicitly so a mismatch is recognized as an authentication failure rather than “fixed” by dropping the context.

Preserve key, IV, tag, and encoding boundaries

Hex and Base64 are representations, not cryptographic algorithms. Verify key length, IV length, ciphertext/tag layout, and text encoding against the protocol you are implementing. A browser round trip only proves compatibility with the same assumptions used by this tool.

Use managed key storage for real secrets

A raw-key utility is useful for test vectors, interoperability checks, and controlled debugging. Production keys should normally be generated, stored, rotated, and access-controlled by an appropriate key-management system or platform API rather than copied through ordinary text fields or chat logs.