AES-GCM (AEAD)

Authenticated encryption (AEAD): AES in counter mode for confidentiality plus a GHASH authentication tag for integrity. Used by TLS 1.3 and WireGuard — flipping a single ciphertext byte makes tag verification fail.

securesymmetric

Plaintext / Input Message

Cryptographic Key / Shift

Auto Compute

Workspace Presets

Save and restore visualizer settings in this browser.

Preset nameSave key with preset — disabled by default. Stored keys remain readable to anyone with access to this browser profile.

Saved presets for this cipher

Output Result

No output

Imported traces are validated and replayed locally. They never run a cipher operation automatically.

Tamper Demo — Integrity vs. Confidentiality

Seal a message, flip one ciphertext byte, then decrypt. GCM verifies the GHASH tag first, so any change is rejected instead of silently returning corrupted plaintext.

PlaintextKey (hex or passphrase)