Which Jasypt algorithm is supported?

Only PBEWITHHMACSHA512ANDAES_256, the current default algorithm in jasypt-spring-boot, is supported. Older defaults like PBEWithMD5AndDES are not supported.

Is the result exactly compatible with the real Jasypt library?

Yes. It has been verified through byte-for-byte matching with fixed salt/IV values, decrypting values encrypted by the real Jasypt library, and having the real Jasypt library decrypt values encrypted with this tool — a full round-trip test.

Is the password (master key) or input sent to a server?

No. Both PBKDF2 key derivation and AES-256-CBC encryption/decryption are handled by the browser's Web Crypto API.

Same value encrypts differently — is that OK?

Yes. Random IV and salt make every ciphertext unique, yet all decrypt to the same original.

What if I lose the master password?

The ciphertext cannot be recovered. Keep the password in a safe place like a secrets manager.

🔒 Jasypt Encrypt/Decrypt

Encrypt or decrypt Spring Boot jasypt (PBEWITHHMACSHA512ANDAES_256) values. Compatible with ENC(...) values in application.properties.

⚠️ Only PBEWITHHMACSHA512ANDAES_256 (the current jasypt-spring-boot default) is supported

Master Password

Encrypt Decrypt

Plaintext

The result will appear here

How to use

Enter the master password set in jasypt.encryptor.password.
Choose Encrypt or Decrypt and enter the value.
Copy the result to place inside ENC(...) in application.properties, or read the decrypted original.

🎯 Use Cases

Encrypt DB passwords or API keys in Spring Boot config files — generate the value to wrap in ENC(...)
Check the plaintext behind a deployed ENC(...) value — decrypt quickly without a local jasypt CLI
Re-encrypt existing values before rotating the master password

Example

Input

Master password: mySecretKey
Mode: Encrypt
Plaintext: db-p@ssw0rd

Output

ENC(ChssPU5fYHGCk6S1xtfo+REiM0RVZneImaq7zN3u/wBMwXcIuLW3bqDylAmmtp/w)

This is db-p@ssw0rd encrypted with the master password mySecretKey. Because a fresh random salt and IV are used each run, the ENC(...) value differs every time, yet decrypting any of them with the same master password returns the original db-p@ssw0rd.

How jasypt works

jasypt encrypts sensitive values in Spring config files as ENC(...) placeholders.

Element	Details
Algorithm	PBEWITHHMACSHA512ANDAES_256 — derives an AES-256 key from a master password
Notation	`ENC(ciphertext)` — placed inside application.properties
Master key	`jasypt.encryptor.password` — passed via env var or JVM option, never committed
Compatibility	Put this tool's output inside ENC(...) and Spring decrypts it at boot

FAQ

Which Jasypt algorithm is supported?: Only PBEWITHHMACSHA512ANDAES_256, the current default algorithm in jasypt-spring-boot, is supported. Older defaults like PBEWithMD5AndDES are not supported.
Is the result exactly compatible with the real Jasypt library?: Yes. It has been verified through byte-for-byte matching with fixed salt/IV values, decrypting values encrypted by the real Jasypt library, and having the real Jasypt library decrypt values encrypted with this tool — a full round-trip test.
Is the password (master key) or input sent to a server?: No. Both PBKDF2 key derivation and AES-256-CBC encryption/decryption are handled by the browser's Web Crypto API.
Same value encrypts differently — is that OK?: Yes. Random IV and salt make every ciphertext unique, yet all decrypt to the same original.
What if I lose the master password?: The ciphertext cannot be recovered. Keep the password in a safe place like a secrets manager.