AES-GCM · authenticated encryption

AES-GCM encryption and decryption

GCM is the recommended AES mode: it encrypts and adds a 16-byte authentication tag, so a wrong key or a changed byte is rejected instead of giving garbage. Enter your key, a 12-byte nonce and optional AAD to test your implementation. Output is ciphertext with the tag at the end, which is what Java returns and what Node gives with getAuthTag().

How to use the tool

  1. 1

    Pick the key size

    GCM works with 128, 192 and 256-bit keys. Enter the key or press Generate.

  2. 2

    Set a 12-byte nonce

    GCM’s IV is usually called a nonce. Press Generate for 12 random bytes. Other lengths work but are rarely used.

  3. 3

    Add AAD if your code does

    If your code calls updateAAD or setAAD, enter the same text. Otherwise leave it empty.

  4. 4

    Check the tag

    Decrypting verifies the tag first. If anything differs, you get “Authentication failed” rather than wrong text.

QRScanKaro

Just need to lock a message?

Text Encryption is simpler: pick a password and share the result. No keys, IVs or modes to set.

Encrypt with a password →

Frequently asked questions

Where is the authentication tag?

In the last 16 bytes of the output. Java’s Cipher and PyCryptodome’s ciphertext + tag produce exactly this. In Node, append cipher.getAuthTag() when encrypting, and when decrypting pass those last 16 bytes to decipher.setAuthTag().

What happens if I reuse a nonce?

With the same key, a reused nonce lets an attacker XOR two ciphertexts to learn about both texts, and even forge tags. Always use a fresh random 12-byte nonce, or a counter that never repeats, for every message.

What is AAD for?

Additional authenticated data is information that travels in the clear but must not be changed, like a message header, user ID or version number. The tag covers it, so decryption fails if the AAD differs even by one character.

Why does decryption say “Authentication failed”?

The tag didn’t match. The key, nonce or AAD is different, or the ciphertext was cut or changed. GCM refuses to return any text in that case, which protects you from acting on tampered data.