Cryptography
Secure encryption, decryption, and digital signatures using AES-256 and RSA-2048
Cryptography Information:
- AES-256: Advanced symmetric encryption with 256-bit keys
- RSA-2048: Asymmetric encryption with 2048-bit key pairs
- Digital Signatures: RSA-SHA256 for message authentication
- Security: All processing done server-side with secure key generation
About the Cryptography Tool
Cryptography underpins secure communication: symmetric ciphers protect bulk data with a shared key, and asymmetric algorithms let two parties exchange that key or prove who they are without ever sharing a secret.
This tool exposes the primitives directly so you can generate keys, encrypt and decrypt, and sign and verify. Symmetric support covers AES in 128, 192 and 256-bit strengths across ECB, CBC and GCM modes, plus Triple DES for interoperability with older systems. Asymmetric support covers RSA key generation from 1024 to 4096 bits, ECDSA across common curves, RSA key transport and digital signatures.
How to use it
- 1Generate a key. Choose a symmetric key of the right length for your cipher, or generate an RSA or ECDSA key pair in PEM form.
- 2For symmetric encryption, supply the key and — for CBC and GCM — the initialisation vector. Never reuse an IV with the same key.
- 3Encrypt or decrypt your text. Where the mode supports authentication, keep the authentication tag with the ciphertext; decryption fails without it.
- 4For signatures, sign with a private key and verify with the matching public key. For key transport, encrypt with the public key and decrypt with the private one.
When you would use it
- Encrypting a message or a file with a shared password before sending it over a channel you do not trust.
- Generating an RSA or ECDSA key pair to test a signing or key-exchange flow.
- Verifying a signature to confirm a payload really came from the holder of a private key.
How it works, and what it does not do
Symmetric encryption uses AES in the mode you select. AES-256-GCM is the sensible default: it authenticates as well as encrypts, so a ciphertext that has been altered fails to decrypt rather than decrypting into plausible garbage. CBC is compatible with more systems but provides no integrity on its own. ECB is listed for illustration only — it encrypts identical blocks into identical output, leaking the structure of the plaintext, and should never protect real data.
The operational details are what people trip over. The initialisation vector is generated for you and returned with the ciphertext, and the same one must be supplied to decrypt. GCM additionally returns an authentication tag, and decryption requires it. A missing IV on decrypt is reported as an error instead of being invented, because inventing one would silently produce nonsense rather than telling you the input was incomplete.
Frequently asked questions
Should I use this tool to protect real secrets?
No. Use it for learning, debugging and testing. This tool performs its work on our servers rather than in your browser, it has not been independently audited, and some modes are offered that modern guidance discourages. For anything that matters, use a vetted library or tool on a machine you control.
Which AES mode should I choose?
GCM where it is available, because it authenticates the ciphertext as well as encrypting it, so tampering is detected. Avoid ECB entirely — it encrypts identical blocks to identical output, which leaks the structure of your data even though the bytes are transformed.
Why is an initialisation vector needed?
Block ciphers are deterministic, so encrypting the same plaintext with the same key twice would produce identical ciphertext — which leaks information and enables replay. The IV randomises each encryption so that identical inputs produce different outputs.
What is the difference between encrypting and signing?
Encryption hides content, so only the holder of the key can read it. Signing does not hide anything — it proves the message came from the holder of the private key and has not been altered. You generally want both for a secure message.
Can I decrypt data produced by another tool?
Yes, if it used one of the standard modes offered here. You need the same key and the same initialisation vector that were used to encrypt, and for GCM you also need the authentication tag. The output is standard AES, so a trusted local implementation can read it.
Where is my key kept?
Nowhere. Each request carries its own key, which is used in memory for that operation and never logged or persisted. The flip side is that nobody can recover it for you — lose the key and the ciphertext is unreadable, which is the expected property of encryption done properly.