piapia123
en

Ansible Vault Encrypt and Decrypt

Encoding

Everything runs locally in your browser — nothing is uploaded

Input
Drop a file here to load its contents
Output

Byte-for-byte compatible with `ansible-vault`: keys come from PBKDF2-HMAC-SHA256(passphrase, salt, 10000 rounds, 80 bytes) — the first 32 bytes key AES-256-CTR, the next 32 key the HMAC, the last 16 are the IV; the body is double hex carrying the salt and HMAC. Decryption verifies the HMAC before decrypting, so a wrong passphrase gives a clear error instead of garbage. Both the `1.1` and `1.2` (`vault-id` label) headers are supported. Everything runs locally; neither the passphrase nor the plaintext is uploaded.

Features

  • The same key derivation as ansible-vault: PBKDF2-HMAC-SHA256, 10000 rounds
  • AES-256-CTR (full-block counter) with PKCS#7 padding
  • Double-hex envelope wrapped at 80 characters per line
  • Both the 1.1 and 1.2 (vault-id label) headers
  • Verifies the HMAC before decrypting, so a wrong passphrase is a clear error
  • Encryption salts come from crypto.getRandomValues
  • A pure-JS AES that does not depend on Web Crypto (https-only)
  • Copy a single row, or all of them

How to use

  1. Choose Encrypt or Decrypt and enter the passphrase
  2. Encrypt: paste the plaintext (optionally add a vault-id label)
  3. Decrypt: paste the whole `$ANSIBLE_VAULT` text
  4. Results and the breakdown (salt, HMAC, header) appear at once

FAQ

What happens with the wrong passphrase?
You get a clear "HMAC verification failed". This differs from many symmetric tools, where a wrong key silently "succeeds" and yields random bytes. Ansible verifies the HMAC before decrypting, and so does this tool — a clear error beats a screen of garbage you have to guess about.
Why is the file double-hex encoded?
The body is first the ASCII text `hex(salt) \n hex(hmac) \n hex(ciphertext)`, and that whole thing is hex-encoded once more, then wrapped at 80 columns. Decoding only once gives something that looks like text but is really hex — that is Ansible’s own format, not a mistake here.
Is the passphrase protection strong?
Vault uses 10000 PBKDF2 rounds, which is low by today’s standards; what holds up is the strength of the passphrase itself. Changing the count would break compatibility, so do not expect it to get stronger — use a long random vault passphrase, not a dictionary word.
Can it handle binary content?
No. This tool treats the payload as UTF-8 text and says so plainly when the decrypted bytes are not valid text (an encrypted keystore, say). For binary, use the `ansible-vault` command.

Related tools

AES / DES

Encoding

Encrypt and decrypt text with AES, DES or 3DES across CBC, GCM, CTR and ECB modes, with keys as text, hex or Base64. Runs in your browser.

HMAC

Encoding

Sign a message with a secret key using HMAC and get a result matching Node, Java and Python. The key never leaves your browser — nothing is uploaded.

Hash

Encoding

Compute MD5, SHA-1, SHA-256, SHA-512 or MD4 digests of any text, hashed as UTF-8 bytes so they match openssl exactly. Runs in your browser.

Base64

Encoding

Convert text to Base64 and back, with correct UTF-8 handling for accents, CJK and emoji. Runs entirely in your browser — nothing is uploaded.

URL Encode

Encoding

Escape text into %XX form and back again, treating a whole URL and a single parameter value as different jobs. Runs entirely in your browser.

HTML Entities

Encoding

Turn < > & and quotes into HTML entities and decode them back in a single pass, so &amp;lt; becomes &lt;, not an angle bracket. Runs in your browser.

← Back to all tools