Which Jasypt algorithm is supported?

Only PBEWITHHMACSHA512ANDAES_256, the current default algorithm in jasypt-spring-boot, is supported. Older defaults like PBEWithMD5AndDES are not supported.

Is the result exactly compatible with the real Jasypt library?

Yes. It has been verified through byte-for-byte matching with fixed salt/IV values, decrypting values encrypted by the real Jasypt library, and having the real Jasypt library decrypt values encrypted with this tool — a full round-trip test.

Is the password (master key) or input sent to a server?

No. Both PBKDF2 key derivation and AES-256-CBC encryption/decryption are handled by the browser's Web Crypto API.

🔒 Jasypt Encrypt/Decrypt

Encrypt or decrypt Spring Boot jasypt (PBEWITHHMACSHA512ANDAES_256) values. Compatible with ENC(...) values in application.properties.

⚠️ Only PBEWITHHMACSHA512ANDAES_256 (the current jasypt-spring-boot default) is supported

Master Password

Encrypt Decrypt

Plaintext

The result will appear here

How to use

Enter the master password set in jasypt.encryptor.password.
Choose Encrypt or Decrypt and enter the value.
Copy the result to place inside ENC(...) in application.properties, or read the decrypted original.

🎯 Use Cases

Encrypt DB passwords or API keys in Spring Boot config files — generate the value to wrap in ENC(...)
Check the plaintext behind a deployed ENC(...) value — decrypt quickly without a local jasypt CLI
Re-encrypt existing values before rotating the master password

Example

Input

Master password: mySecretKey
Mode: Encrypt
Plaintext: db-p@ssw0rd

Output

ENC(ChssPU5fYHGCk6S1xtfo+REiM0RVZneImaq7zN3u/wBMwXcIuLW3bqDylAmmtp/w)

This is db-p@ssw0rd encrypted with the master password mySecretKey. Because a fresh random salt and IV are used each run, the ENC(...) value differs every time, yet decrypting any of them with the same master password returns the original db-p@ssw0rd.

FAQ

Which Jasypt algorithm is supported?: Only PBEWITHHMACSHA512ANDAES_256, the current default algorithm in jasypt-spring-boot, is supported. Older defaults like PBEWithMD5AndDES are not supported.
Is the result exactly compatible with the real Jasypt library?: Yes. It has been verified through byte-for-byte matching with fixed salt/IV values, decrypting values encrypted by the real Jasypt library, and having the real Jasypt library decrypt values encrypted with this tool — a full round-trip test.
Is the password (master key) or input sent to a server?: No. Both PBKDF2 key derivation and AES-256-CBC encryption/decryption are handled by the browser's Web Crypto API.