aes-encryption.com
English

AES · GCM / CBC / CTR

What Is AES Encryption? Keys, Blocks and Recovery

Understand what AES protects, how its key and mode fit together, and why authentication and a complete recovery format matter.

The cipher and the message format

AES transforms 128-bit blocks with a symmetric key. AES-128, AES-192 and AES-256 describe key lengths, not different block sizes. A mode such as GCM, CBC or CTR specifies how the block cipher handles a message and parameters. Saying only AES-256 does not tell a recipient the nonce, mode, padding or password derivation.

Encryption can conceal content, while authentication detects changes under the selected key. These are separate requirements. GCM combines them; raw CBC and CTR do not. A longer key cannot compensate for a reused nonce or an unauthenticated mode.

A practical text example

Start with the public text Hello, AES! and the public test password in the encryption tool. Encrypt twice. The package values differ because the tool generates fresh salts and nonces. Both packages can still restore the same text with that password. This difference is expected, not evidence of unreliable output.

Save the entire JSON package. The password is not stored in it, but the salt, nonce, version and KDF parameters are. A recipient needs the password separately. Copying only ciphertext loses context; Base64 is merely a byte encoding and does not supply that missing context.

What local processing does and does not mean

The sensitive workspace runs on a separate origin, without advertising, analytics or session replay. Input is processed in a Worker rather than uploaded for encryption. Normal requests still load code, styles and images from the host, and the outer page can still influence what a user sees. This architecture reduces direct access to form fields; it is not an audit or an absolute safety promise.

Choose the appropriate task

Use password mode for this site's versioned text or file packages. Use raw mode only when you have the exact protocol parameters of another system. Use the key generator for random byte keys, not for recovering a lost password. Keep a recovery test and a separate original before relying on an encrypted archive.

Technical references

Updated October 16, 2026

Frequently asked questions

Does AES mean AES-256?

No. AES supports 128, 192 and 256-bit keys, all with a 128-bit block size.

Does AES encryption authenticate the sender?

Not by its name alone. GCM authenticates data under the shared key, but does not establish a person's identity without a wider trust and key-distribution system.