Try AES-GCM, AES-CBC, and AES-CTR with a self-contained browser AES implementation. The lab shows ciphertext, GCM authentication tags, nonce rules, and how block changes appear under each mode.
0 bytes
0 bytes
GCM usually uses a 12-byte nonce; CBC and CTR require 16-byte inputs for this lab.
0 bytes
GCM verifies AAD during decryption. If the decrypt-side AAD differs from the encrypt-side AAD, authentication fails.
Key preview
Educational view of the raw AES key. Production systems should not display or log keys.
Base64:
Choose a mode, generate a key or encrypt to auto-generate one, then decrypt with the same key and IV/nonce.
Ciphertext
Decrypted output
Decrypt uses the current mode, key, and IV/nonce. GCM also uses the tag and the exact AAD.
CTR insight
Full 16-byte counter block:
With a 64-bit counter field, the first 8 bytes are the nonce prefix and the last 8 bytes increment as the counter.
Same plaintext with a new nonce gives a different keystream and different ciphertext.
Block Diff Explorer
Compare two encryptions with either a controlled shared IV/nonce or realistic fresh IVs/nonces. The controlled mode isolates how plaintext changes propagate; the realistic mode shows why fresh IVs/nonces make similar messages look unrelated.
CBC: a plaintext change in block N changes ciphertext block N and following blocks.
CTR: only blocks containing changed plaintext bytes differ.
GCM: ciphertext body behaves like CTR; the authentication tag covers plaintext and AAD.
0 bytes
0 bytes
GCM tag comparison appears below when AES-GCM is selected.
Ciphertext A blocks
Ciphertext B blocks
Legend: [same] identical block, [diff] different block. Block size is 16 bytes.
ECB-style Visualization (Unsafe)
Browsers do not expose AES-ECB through WebCrypto. This demo encrypts each 16-byte block with the lab's local AES block function and a fixed demo key. Equal plaintext blocks map to equal outputs, which illustrates ECB pattern leakage.
Real ECB would encrypt padded 16-byte blocks. For visualization, a short final block is zero-padded before the stand-in block encryption.
Guidance
Prefer AEAD
AES-GCM provides confidentiality and integrity in one operation. CBC and CTR only provide confidentiality unless you add a separate MAC.
Protect metadata with AAD
Use AAD for headers, routing fields, protocol versions, and other metadata that should be authenticated but not encrypted.
Never reuse CTR/GCM nonces
CTR nonce reuse repeats the keystream. GCM nonce reuse also breaks authentication and can enable forgeries.
Use random keys and careful IVs
Generate keys with a CSPRNG. CBC needs an unpredictable 16-byte IV; CTR needs a unique 16-byte counter block; GCM normally uses a unique 12-byte nonce.