Skip to main content

Envelope Encryption

v1.0.0

Encrypt data with a random DEK, then wrap the DEK with a KEK — the industry-standard pattern used by AWS KMS, GCP CMEK, and Azure Key Vault.

Browser-based Envelope Encryption. All operations run locally — no data is sent to a server.

How to use
  • →Enter your input data and configure the operation settings.
  • →Click Run to compute the result.
  • →Use the Copy button to copy the output.
  • →Try a preset from the example picker to see sample input.
Generate random DEK → Encrypt data with DEK (AES-256-GCM) → Wrap DEK with KEK → Output wrapped DEK + ciphertext + IV
Key Encryption Key (KEK)
Encrypt data with random DEK, then wrap DEK with KEK
Plaintext