Vai al contenuto
DevTools / Cifratura AES e RSA

Cifratura AES e RSA

Sometimes you need to hand a secret to a colleague over a channel you do not trust, or check that the ciphertext your service produced actually decrypts with the key you think it does. This tool performs real authenticated encryption with the Web Crypto API — the same audited native implementation your browser uses for TLS — covering AES-GCM, AES-CBC, Triple DES and RSA-OAEP, with key generation for RSA and a clear explanation of which modes are safe and which exist only for compatibility.

Funziona interamente nel browser — non viene caricato nulla.

Ancora nulla da mostrare

Output layout: Base64( salt[16] ‖ IV ‖ ciphertext ). Key derived with PBKDF2-SHA256, 150 000 iterations.

Come funziona

AES is a block cipher with a 128-bit block size and a key of 128, 256 or (rarely) 192 bits. A block cipher alone can only encrypt exactly one block, so it needs a mode of operation to handle anything longer. The mode is where the security is won or lost. AES-GCM is an authenticated mode: alongside the ciphertext it produces an authentication tag, and decryption refuses to return plaintext if that tag does not match. That single property defeats an entire class of attacks, because an adversary who flips a bit in transit causes a hard failure rather than a silently corrupted message.

GCM needs a nonce — a number used once — which is typically 96 bits of random data. The nonce is not secret and is normally prefixed to the ciphertext. What matters absolutely is that the same key and nonce pair is never reused: doing so leaks the XOR of the two plaintexts and, worse, allows an attacker to forge tags. This tool generates a fresh random nonce on every encryption and keeps it with the output, which is why encrypting the same text twice gives two different ciphertexts.

CBC is the older mode and is included only because so much existing code uses it. It chains each block into the next and requires an initialisation vector, which like a GCM nonce must be unpredictable. Crucially, CBC provides no authentication on its own: an attacker can flip bits in the ciphertext and know exactly which bits of the next plaintext block will flip. Padding-oracle attacks against unauthenticated CBC were the mechanism behind several high-profile breaches. If you are writing new code, use GCM; if you must use CBC, encrypt-then-MAC with a separate key.

RSA is an asymmetric cipher, so it solves a different problem: the encryptor uses a public key and only the holder of the matching private key can decrypt. Its mathematics — modular exponentiation over the product of two large primes — is slow and limited to payloads smaller than the key size, so RSA is nearly always used to encrypt a symmetric key that then encrypts the bulk data. This tool implements RSA-OAEP with SHA-256, the padding scheme that replaced the vulnerable PKCS#1 v1.5 for encryption. Key pairs are generated locally with the browser's CSPRNG.

Casi d'uso comuni

  • Send a password or an API key to a colleague over chat without putting the plaintext in the message.
  • Verify that a ciphertext your application produced decrypts correctly with the key you configured.
  • Generate an RSA key pair to test a signature or encryption flow against your own service.
  • Confirm which AES mode and IV a legacy system is using by decrypting a known plaintext sample.
  • Produce a short AES-GCM test vector to paste into a unit test.
  • Check whether a vendor's documentation about authenticated encryption matches what their SDK actually emits.

Ultimo aggiornamento: 2026-10-14 — il corpo dell'articolo è mostrato in inglese; l'interfaccia è tradotta.

Domande frequenti

Which mode should I choose?

AES-GCM, unless you have a specific reason not to. It is authenticated, so tampering is detected rather than silently accepted, it is fast and it is hardware-accelerated on essentially every modern CPU. AES-CBC and Triple DES are present for compatibility with existing systems only. Triple DES in particular is obsolete: its 64-bit block size makes it vulnerable to birthday attacks on large volumes of data, and it has been deprecated by NIST since 2023.

Where does my passphrase go?

Nowhere. The key derivation, encryption and decryption all happen inside your browser through the Web Crypto API, which is the same native code path the browser uses for HTTPS. The page makes no network request during encryption, so you can verify the claim by opening the network panel in your developer tools and watching it stay empty. That said, a passphrase typed into a browser on a shared or compromised machine is still exposed to keyloggers and extensions, which no client-side tool can defend against.

Why can I not encrypt large amounts of data with RSA?

Because RSA operates on a single number smaller than the modulus. A 2048-bit key can encrypt at most 245 bytes with OAEP-SHA256, and a 4096-bit key at most 501 bytes. The standard solution is hybrid encryption: generate a random AES key, encrypt the payload with AES-GCM, then encrypt that AES key with RSA and send both. This is exactly what TLS and PGP do, and it is why RSA appears to be fast in practice despite its slow primitive.

Is decrypting with the wrong key supposed to fail loudly?

With AES-GCM it should, and that is the point. An incorrect key produces the wrong authentication tag, so decryption fails outright instead of returning garbage. With AES-CBC you get either a padding error or plausible-looking nonsense. If a system returns garbage rather than an error when the key is wrong, that is a sign it is using an unauthenticated mode, and it is worth asking what else it is not checking.

Strumenti correlati