对称加密工具 使用教程
详细使用指南、最佳实践与常见问题解答
使用场景
对称加密工具适用于敏感数据传输、配置文件加密、API 密钥保护、数据库字段加密等场景。支持国际算法 AES-256 与国密 SM4:国际业务用 AES,符合国密合规要求用 SM4,两者都在浏览器本地完成,密钥永不离开设备。
Use Cases
The symmetric encryption tool is useful for sensitive data transmission, config file encryption, API key protection, database field encryption, etc. Supports both international AES-256 and Chinese standard SM4: AES for global use, SM4 for compliance with Chinese cryptographic regulations. Both run locally in the browser; keys never leave the device.
功能特点
- AES-256-GCM:推荐模式,带认证标签,可检测密文篡改
- AES-256-CBC:兼容传统系统,无认证
- SM4-ECB/SM4-CBC:国密对称加密(GB/T 32907-2016),128 位密钥
- 密码派生:AES 用 PBKDF2(10 万次 + SHA-256);SM4 用 SM3 + salt
- Hex 密钥:AES 64 hex / SM4 32 hex,适合专业用户
- 完全本地:Web Crypto API + 纯 JS SM4,密钥永不离开浏览器
- UTF-8 安全:正确处理中文等非 ASCII 字符
Features
- AES-256-GCM: recommended mode with authentication tag, tamper-detecting
- AES-256-CBC: legacy compatibility, no authentication
- SM4-ECB/SM4-CBC: Chinese standard symmetric cipher (GB/T 32907-2016), 128-bit key
- Password-derived: AES uses PBKDF2 (100k iter + SHA-256); SM4 uses SM3 + salt
- Hex key: AES 64 hex / SM4 32 hex for advanced users
- Fully local: Web Crypto API + pure JS SM4, key never leaves the browser
- UTF-8 safe: correctly handles non-ASCII characters like Chinese
使用示例
示例 1：场景一:加密 API 密钥保存到笔记 — 输入密钥、设置密码、选 AES-GCM、点加密,把 base64 密文存到笔记,需要时再粘贴回来解密。
示例 2：场景二:发送私密消息给同事 — 用约定好的密码加密消息,通过微信/邮件发送密文,对方用同样密码解密。
示例 3：场景三:国密合规 — 金融/政务系统要求数据加密符合国密标准,选 SM4-CBC 模式,密钥通过安全渠道告知对方。
Examples
Example 1: Scenario 1: Encrypt an API key for note storage — input the key, set a password, choose AES-GCM, click Encrypt, save the base64 ciphertext; decrypt later when needed.
Example 2: Scenario 2: Send a private message to a colleague — encrypt with a shared password, send the ciphertext via chat/email, the recipient decrypts with the same password.
Example 3: Scenario 3: Chinese compliance — financial/government systems requiring SM4; choose SM4-CBC mode, share the key via a secure channel.
最佳实践
- 优先使用 GCM 模式,带认证可防篡改
- 国密合规场景选 SM4-CBC(带 IV 比 ECB 更安全)
- 密码至少 12 位,包含大小写字母、数字、符号
- PBKDF2 迭代次数越高越安全(本工具为 10 万次)
- 密文传输时配合 HTTPS,防止中间人攻击
- hex 密钥需通过安全渠道(如线下、密码管理器)分享,不要明文传输
Best Practices
- Prefer AES-GCM mode — authenticated, tamper-resistant
- For Chinese compliance, choose SM4-CBC (with IV, safer than ECB)
- Password at least 12 chars with mixed case, digits, symbols
- Higher PBKDF2 iterations = more secure (this tool uses 100,000)
- Always pair ciphertext with HTTPS to prevent MITM attacks
- Share hex keys only via secure channels (offline, password manager) — never in plaintext
常见问题
我的密码会被上传吗?
不会。所有加解密都在你的浏览器本地完成,密码和密钥永不离开你的设备。
AES 和 SM4 怎么选?
国际业务或无合规要求时选 AES-256-GCM(更安全,带认证);国密合规场景(金融/政务/等保)选 SM4。两者密钥长度不同:AES 256 位,SM4 128 位。
GCM 和 CBC 怎么选?
GCM 是推荐模式,带认证标签,可检测密文是否被篡改。CBC 仅用于兼容旧系统,无认证,更容易被攻击。
密文格式是什么?
AES 密码模式:base64(salt[16] + iv + ciphertext);Hex 模式:base64(iv + ciphertext)。SM4-CBC 密码模式:base64(salt[16] + iv[16] + ciphertext);SM4-ECB 无 IV。
解密失败怎么办?
检查:1) 密码/密钥是否正确 2) 算法模式是否与加密时一致 3) 密文是否完整复制 4) 是否选错密钥来源(密码/hex)。
FAQ
Will my password be uploaded?
No. All encryption/decryption is done locally in your browser; password and key never leave your device.
How to choose between AES and SM4?
Use AES-256-GCM for international use or when no compliance is required (more secure, authenticated). Use SM4 for Chinese compliance (finance/government/MLPS). Different key lengths: AES 256-bit, SM4 128-bit.
How to choose between GCM and CBC?
GCM is recommended — it has an authentication tag to detect tampering. CBC is only for legacy systems; no authentication, more vulnerable.
What is the ciphertext format?
AES password mode: base64(salt[16] + iv + ciphertext); Hex mode: base64(iv + ciphertext). SM4-CBC password mode: base64(salt[16] + iv[16] + ciphertext); SM4-ECB has no IV.
What if decryption fails?
Check: 1) correct password/key 2) algorithm mode matches encryption 3) full ciphertext copied 4) correct key source (password/hex) selected.