How to encrypt and decrypt text

Five passphrase ciphers on one screen: AES, DES, RC4, Rabbit and TripleDES. Pick an algorithm, paste text, press Encrypt, and the result appears below; paste that result back with the same passphrase and press Decrypt to recover the original.

The ciphers run inside the page through CryptoJS. Text and passphrase never leave the browser, which is also why the tool keeps working with the network disconnected.

Paste or type the text in the field above. AES is selected by default; choose another algorithm only when you have to match ciphertext that already exists.
Type the passphrase in the key field. The same passphrase will be needed to read the result later — nothing is stored here.
Press Encrypt. The output is Base64 and starts with U2FsdGVkX1, the marker of an OpenSSL-style salted container.
To reverse it, paste the ciphertext into the same field, select the algorithm that produced it and press Decrypt.

What the output really is

The salted container and its random salt

Every result is a container in the OpenSSL style: the eight bytes Salted__ (U2FsdGVkX1 in Base64), eight random bytes of salt, then the ciphertext. Key and IV are derived from the passphrase and that salt with the MD5-based EVP_BytesToKey that openssl enc uses with -md md5.

Because the salt is random, the same text with the same passphrase produces a different string every time. Two identical outputs would be a fault; different ones are expected.

Which cipher is actually used

AES runs as aes-256-cbc, DES as des-cbc and TripleDES as des-ede3-cbc — all three can be decrypted by OpenSSL, for example with openssl enc -d -aes-256-cbc -md md5 -k "passphrase". RC4 is keyed with 256 bits, twice the 128-bit default that openssl enc -rc4 derives, so that command does not read the output back. Rabbit exists only in CryptoJS and has no OpenSSL counterpart.

AES, DES and TripleDES are block ciphers in CBC mode with PKCS#7 padding; RC4 and Rabbit are stream ciphers, so their ciphertext is as long as the plaintext.

Decrypting with the wrong passphrase

AES, DES and TripleDES fail the padding check and return nothing; RC4 and Rabbit produce bytes that are almost never valid UTF-8. In both cases the page now reports the failure and clears the output area instead of leaving the previous plaintext on screen.

The container carries no integrity check — no MAC and no authenticated tag — so an altered ciphertext is not detected and a wrong passphrase cannot be told apart from damaged text. Compare one small known sample before a decrypted value goes into an automated pipeline.

What the page will not do

It works on text, not files, and it does not sign, verify or keep anything: no history, no stored key, no result after a reload.

DES, RC4 and TripleDES stay available for compatibility with existing data. A key derived from a passphrase in CBC mode is not a modern construction; for new work use AES-GCM or ChaCha20-Poly1305, which this page cannot produce.