One tool, many ways to work with text: real AES-256 encryption, JWT encode/decode with signature verification, everyday encodings like Base64 and Hex, classic ciphers like Caesar and Vigenère for learning, and one-way MD5/SHA hashing for checksums. Nothing you type here is sent anywhere.
Free to use · Runs entirely on your device · No sign-up
AES · JWT · 6 encodings/ciphers · 4 hash functions
AES-256 is real, key-based encryption. JWT encodes and
signs a JSON payload with HS256. Base64 and Hex are
encodings, not secrecy. Caesar, ROT13, XOR
and Vigenère are classical ciphers for puzzles and learning.
MD5/SHA hashes cannot be reversed.
Pick an algorithm, switch between Encrypt and Decrypt, add a key if the cipher needs one, and go.
AES-256 derives a key from your password with PBKDF2 (100,000 rounds) and encrypts with AES-GCM. The output includes a random salt and IV, so encrypting the same text twice gives a different result each time — that's expected.
No account, no upload, no server round-trip for any of the cipher work.
Pick your direction first — hashing algorithms only support Encrypt, since a hash can't be reversed.
AES, Caesar, XOR and Vigenère ask for a key or password. Base64, Hex, ROT13 and hashing need nothing extra.
The result sits in the right-hand pane. Use "Swap input ↔ output" to feed a result straight back in the other direction.
Not everything called a "cipher" here is meant to keep a secret. This is what each one is really for.
Industry-standard AES-GCM with a key derived from your password via PBKDF2. This is the only option on this page suitable for text you genuinely need to protect. Forgetting the password means the ciphertext is unrecoverable — there is no back door.
Use for real secretsThese reshape text into a different alphabet so it survives being pasted into places that dislike raw bytes, such as URLs, JSON or email. Anyone can decode them instantly with no key at all.
Not secrecyA JWT is a signed, Base64URL-encoded JSON payload — not encrypted. Anyone can read the header and claims without a key; the secret only proves the token wasn't tampered with. Encode signs a JSON payload with a secret; Decode reads any token's claims and, if you supply the same secret, tells you whether the signature checks out.
Signed, not privateA Caesar cipher shifts every letter by a fixed number of places; ROT13 is just a Caesar cipher fixed at 13. Both are broken by trying 25 shifts by hand, so treat them as puzzles, not protection.
Learning & puzzlesXOR combines your text with a repeating key byte-by-byte; Vigenère does the same idea with letters. Both are a step up from Caesar but fall quickly to basic frequency analysis once the key is shorter than the message.
Learning & puzzlesA hash turns text into a fixed-length fingerprint that can't be turned back into the original — there is no "Decrypt" for these. Use them to verify a file wasn't altered or to check two pieces of text match. MD5 and SHA-1 are fine for checksums but are not considered secure against a determined attacker; prefer SHA-256 or SHA-512 where security matters.
Verification, not secrecySending a password or plaintext to a server just to scramble it defeats the point. Every algorithm here, AES included, runs locally using the Web Crypto API built into your browser.
A password typed into the AES field is used to derive a key in memory and is never transmitted anywhere, including to KRHTech.
Once the page is loaded, every cipher and hash function keeps working without a network connection.
The classical ciphers are clearly marked as learning tools, not security, so you don't reach for the wrong one by accident.
If something here isn't covered, the main site's contact page can reach a real person.
No. Every cipher on this page, including AES-256, runs inside your browser using the Web Crypto API. Your plaintext, keys and ciphertext never leave your device.
AES-256 is the only option here suitable for protecting real, sensitive data. Base64 and Hex are encodings, not encryption. Caesar, ROT13, XOR and Vigenère are classical ciphers meant for learning and puzzles, not for anything you actually need to keep secret.
No. Hashing is one-way by design, so there is no decrypt step for MD5, SHA-1, SHA-256 or SHA-512 here. They are for checksums and verification, not for recovering the original text.
The ciphertext cannot be recovered. Because the key is derived from your password on your own device and never stored anywhere, there is no reset link and no way for KRHTech to help recover it.