I keep a folder of encrypted notes: a few API keys, some recovery codes, the odd thing I do not want sitting in plaintext on a shared drive. Last week I needed one of them back and could not remember which passphrase variant I had used. After trying two sites that wanted me to paste my key into a server, I ended up on this AES-GCM decryption page. It does one thing, in the tab, with no account.
What it actually takes
You give it a JSON blob with three fields, salt, iv and data, plus the password you used when encrypting. It hands back the original text. That is the whole interface. No drag and drop, no file picker, no settings panel to figure out.
The three fields need to be base64 and the key names need to match exactly. If your own encrypt routine calls them something else, the page will not guess for you. That bit caught me out for ten minutes before I realised I had renamed iv to nonce in my own script.
Why not just write a script
Because a ten line Node script is only convenient when Node is already in front of me. Half the time I am on a borrowed laptop, or on my phone, and the note I need is one string long. Opening a page and pasting two things beats setting up a runtime for a single decryption.
I have been doing this since early 2026, after I stopped trusting browser extensions that claimed to do crypto and asked for broad permissions. A plain page with a textarea is easier to reason about.
Where it falls short
It is GCM only. If your data came out of an AES-CBC routine, this is not the page for you, and no amount of retrying will fix it. There is a matching encrypt page for the other direction, but neither of them handles files or lets you pick a key derivation mode. You are expected to know how the data was produced.
It also will not tell you much when a decryption fails. You get an error, not a diagnosis. Wrong password, wrong IV, malformed base64 and truncated data all look roughly the same, which is fine if you know what you are doing and mildly annoying if you do not.
The obvious question about secrets
Yes, pasting a password into a web page deserves suspicion. The decryption runs in the browser, so the key does not travel, and you can watch the network tab if you want proof. That said, I would not do this on a machine I do not control, and I would not use any web page, this one included, for something where losing the key matters more than saving five minutes.
For the ordinary case, a note I encrypted myself and now need to read, it is the shortest path I have found.
Questions I had before using it
Does the password get sent anywhere? No. The page decrypts locally in the tab, so the key never leaves the device.
Can it handle AES-CBC or files? No. GCM and pasted text only. Use the encrypt page for the reverse direction.
Does it work on a phone? Yes, it is the same page in a mobile browser. I have used it on a train more than once.
What if decryption just fails? Check that your salt, iv and data are base64 and that the field names match what the tool expects before assuming the password is wrong.
If you already encrypt your own notes and just need to read one back, the AES-GCM decrypt page saves you from writing the same script every time. That is the entire reason I keep it bookmarked.