Base64 & AES-256 Cryptography
Use one page for Base64 text conversion or passphrase-based AES-GCM encryption. All operations run in your browser, but Base64 is encoding—not encryption—and the AES format is specific to this tool.
What it does
Base64 represents bytes using printable characters and is commonly used in data URLs, tokens, and configuration values. It provides no secrecy: anyone can decode it.
The AES mode uses the Web Crypto API with AES-GCM and a new random 12-byte initialization vector for each encryption. The passphrase is hashed once with SHA-256 to form the key; this is not a password-hardening KDF, so strong, unique passphrases remain important.
How to use this tool
- Choose Base64 or AES: Select the operation and whether you want to encode/encrypt or decode/decrypt.
- Enter the value: Paste the source text or encoded value. For AES, also enter the required passphrase.
- Run and copy: Process the value, check for an error, then copy the result if it is suitable.
Input and output
Input
- Text to encode or encrypt, or a Base64/ciphertext string to decode or decrypt.
- A passphrase for AES encryption and the identical passphrase for decryption.
Output
- A Base64 string or decoded text.
- A Base64 representation containing the initialization vector followed by AES-GCM ciphertext and authentication tag.
How it works
Base64 conversion
The tool uses the browser btoa and atob functions, which operate on Latin-1 binary strings rather than arbitrary Unicode text.
AES key creation
The passphrase is UTF-8 encoded and hashed once with SHA-256 to create a 256-bit key.
Authenticated encryption
AES-GCM encrypts the UTF-8 text with a random IV; decryption also detects an incorrect passphrase or altered ciphertext.
Practical example
- Scenario
- Sharing a short encrypted note with someone using the same tool
- Action
- Choose AES Encrypt, enter the text and passphrase, then copy the generated Base64 value.
- Input
- Text: Project meeting moved to 10:30; plus a strong shared passphrase
- Expected result
- The recipient can choose AES Decrypt and enter the exact passphrase. Encrypting the same note again produces a different value because the IV is random.
Limitations
- Base64 mode uses btoa/atob semantics and does not directly support arbitrary Unicode characters such as emoji.
- The AES passphrase derivation is a single SHA-256 hash without a salt or deliberately slow password KDF.
- The AES output is a custom IV-plus-ciphertext format and may not interoperate directly with other encryption applications.
- There is no password recovery. A lost or incorrect passphrase makes AES content unavailable.
- This browser utility is not a substitute for an audited key-management or secure-messaging system.
Frequently Asked Questions
Is Base64 encryption?
No. Base64 is a reversible representation of bytes and offers no confidentiality.
Why does AES encryption produce a different result each time?
Each operation creates a random initialization vector. This is expected and helps prevent identical plaintext from producing identical ciphertext.
Why will some Unicode text not Base64-encode?
This implementation uses browser btoa/atob functions, which accept Latin-1 binary strings rather than every Unicode character.
Can another AES application decrypt this output?
Only if it reproduces this tool’s exact SHA-256 key derivation and IV-plus-ciphertext byte format. It is intended primarily for round trips within this tool.