About
endec was created and is maintained by the YouTube channel The Seasoned Programmer. Questions or suggestions? Email info@the-seasoned-programmer.com.
All encryption runs in your browser. AES and ChaCha20 come from the audited noble-ciphers library. Triple DES, DES and RC4 aren't in any browser API or modern library, so they're implemented on this site and tested against the official test vectors and OpenSSL. Password key derivation uses the browser's Web Crypto PBKDF2.
Keys, IVs and nonces
A symmetric cipher uses the same secret key to encrypt and decrypt. Most modes also take an IV (initialization vector) or nonce: a value that isn't secret but must be different for every message encrypted with the same key. It's usually random and sent along with the ciphertext, often stuck on the front of it. Reusing a nonce with GCM, CTR or ChaCha20 is a serious mistake: it can reveal the messages and, for GCM, let an attacker forge new ones.
Block cipher modes
- GCM (Galois/Counter Mode): encryption plus a 16-byte authentication tag. Decryption fails if the ciphertext, nonce or additional data was changed. The recommended mode.
- CBC (Cipher Block Chaining): each block is mixed with the previous one before encryption. Needs padding and an unpredictable IV. Without a separate MAC it's vulnerable to padding-oracle attacks.
- CTR, CFB and OFB: turn the block cipher into a stream cipher, so no padding is needed. No integrity protection.
- ECB (Electronic Codebook): encrypts each block on its own, so identical blocks of plaintext give identical blocks of ciphertext and patterns show through. Don't use it.
Padding
CBC and ECB only work on whole blocks (16 bytes for AES, 8 for DES), so the last block is padded. PKCS#7 adds n bytes each with the value n, which is unambiguous and the standard everywhere; Java calls it "PKCS5Padding". Zero padding is from old PHP code and can't tell padding from real trailing zero bytes.
Passwords and the OpenSSL format
A password isn't a key: it's too short and too guessable. Password mode runs it through a key derivation function with a random 8-byte salt and writes Salted__, the salt and then the ciphertext, which is the format of openssl enc and CryptoJS. In Base64 that always starts with U2FsdGVkX1.
- PBKDF2-SHA256 (
openssl enc -pbkdf2) runs SHA-256 hundreds of thousands of times so each password guess is expensive. This site defaults to 600,000 iterations, the OWASP recommendation; tell OpenSSL with-iter 600000. - EVP_BytesToKey with MD5 (CryptoJS, OpenSSL 1.0) or SHA-256 (
openssl encwithout-pbkdf2) does a single hash and is far too fast. Use it only to open old data.
Standards
- FIPS 197: AES. NIST SP 800-38D: GCM.
- RFC 8439: ChaCha20 and Poly1305.
- SP 800-67: Triple DES (withdrawn 2024). FIPS 46-3: DES (withdrawn 2005).
- RFC 8018: PBKDF2.