All operations

AES

The block cipher behind most encrypted traffic, keyed by a passphrase or raw bytes.

What runs here

Joan Daemen and Vincent Rijmen designed Rijndael. FIPS 197 made it the standard in November 2001, and it now protects most encrypted traffic and most encrypted disks. The work here goes to the browser’s own WebCrypto implementation, at 128 or 256 bits, in one of two modes. The Base64 above is that sentence encrypted under the default passphrase psysecure.

GCM and CBC

GCM authenticates as well as encrypts. A 16-byte tag covers the whole message, and decryption fails outright if a single bit was altered. CBC hides the content and says nothing about integrity, so an edited ciphertext still decrypts to bytes, corrupted in ways an attacker can steer. Vaudenay’s padding oracles in 2002 and Lucky Thirteen in 2013 came out of decryptors that answer questions about malformed input. Pick GCM unless something old forces CBC.

What the Base64 holds

Everything needed to decrypt except the key rides in front of the message: 16 random salt bytes in passphrase mode, the initialization vector at 12 bytes for GCM or 16 for CBC, then the ciphertext with GCM’s tag on the end. An empty message under a passphrase in GCM comes to 44 bytes before Base64.

Nothing records which mode or key size made the blob, so decryption needs both set by hand to match.

Passphrase to key

A typed passphrase goes through PBKDF2-HMAC-SHA-256 at 100,000 rounds against that random salt. Salt and IV are drawn fresh on every run, so the same text under the same passphrase gives a different blob each time. Reload the page and watch it change.

100,000 rounds falls short of current advice: OWASP’s password storage guidance puts PBKDF2-HMAC-SHA-256 at 600,000. Read the figure here as a demonstration.

A raw hex key skips derivation. 32 hex digits for 128 bits, 64 for 256, used as given, no salt in the output.

Doing this in a browser

The bytes never leave the tab, and the tab is still a browser. Extensions can read the page, the clipboard keeps what you copy, and the operating system can write memory to disk. Learn the format here; encrypt anything that matters with a tool you control.

Copy link carries every setting changed from its default, so a typed passphrase sits in that link, along with the input whenever it is under 2000 characters.

RC4 carried a great deal of traffic before AES did, and shows what an unauthenticated keystream costs. HMAC is the integrity half of GCM on its own, for data that is already public. Base64 is the wrapper on the output above.