Encrypt / Decrypt Studio

JWE, AES-GCM/CBC (key or passphrase), and RSA-OAEP / ECDH hybrid encrypt-decrypt — 100% client-side Web Crypto.

Privacy: 100% Client-Side. Your data never leaves this browser tab. Processing uses Web APIs and client-side libraries only.

Encrypt and decrypt locally with Web Crypto — compact JWE (jose), raw AES (GCM/CBC + passphrase), or asymmetric RSA-OAEP / ECDH hybrid. Keys never leave this browser.

Keys

Encrypt / Decrypt

What is Encrypt / Decrypt Studio?

JSON Web Encryption (JWE) wraps plaintext in a compact encrypted envelope for tokens and API payloads. Raw AES and asymmetric modes cover the same job without JOSE packaging — useful for debugging libraries, passphrases, and hybrid ECDH schemes.

This studio runs entirely in your browser via Web Crypto (and jose for JWE). Generate keys in memory, encrypt or decrypt, then Reset to clear sensitive fields.

How to use this tool

  1. Pick JWE, Symmetric (AES), or Asymmetric (RSA-OAEP / ECDH).
  2. Generate or paste a key (JWK / PEM / Hex / Base64) or use a passphrase for AES.
  3. Encrypt to a compact JWE or a JSON envelope { ciphertext, iv, tag?, salt? }, then decrypt on the other tab.

Frequently asked questions

Are encryption keys uploaded?

No. All modes run client-side with Web Crypto / jose and are not sent to stbox servers.

What does Authentication tag mismatch mean?

AES-GCM (and ECDH hybrid) failed integrity or key checks — wrong key/passphrase, IV, tag, or corrupted ciphertext.

Why prefer AES-GCM over AES-CBC?

GCM authenticates ciphertext. CBC with PKCS#7 padding encrypts but does not detect tampering unless you add a separate MAC.