# How I use AES encryption without confusing it with hashing

A beginner-friendly guide to AES encryption, passwords, IVs, decryption, and the limits of browser-based text encryption.

- Date: 2026-09-27
- URL: https://ilham.dev/posts/how-to-use-aes-encryption-for-text/
- Markdown: https://ilham.dev/posts/how-to-use-aes-encryption-for-text/index.md
- Tags: aes, encryption, security, tools
- Reading time: 2 min


AES is for keeping text confidential. It is different from hashing: encrypted text is meant to be decrypted later with the right key, while a hash is not meant to be reversed.

The [AES Encryption](/tools/aes-encryption/) tool gives me a safe place to test the idea before I put it into a script, server, or production workflow.

## The simple mental model

AES is for keeping text confidential. It is different from hashing: encrypted text is meant to be decrypted later with the right key, while a hash is not meant to be reversed.

I try to reduce the tool to one question: what input do I have, what output do I expect, and what would make the result unsafe or misleading?

## Step 1: Decide whether you really need reversible encryption

Decide whether you really need reversible encryption.

Start with a small example first. A small example is easier to inspect than a real production-sized case.

## Step 2: Choose a strong password or key and do not reuse weak secrets

Choose a strong password or key and do not reuse weak secrets.

## Step 3: Encrypt a small test message first

Encrypt a small test message first.

## Step 4: Copy the full output, including any salt or IV data the tool provides

Copy the full output, including any salt or IV data the tool provides.

## Step 5: Decrypt the result immediately to confirm the workflow

Decrypt the result immediately to confirm the workflow.

## Step 6: Store the key separately from the encrypted text

Store the key separately from the encrypted text.

## Step 7: Do not treat encryption as a replacement for access control

Do not treat encryption as a replacement for access control.

## My checklist

Before I trust the result, I check:

- Decide whether you really need reversible encryption.
- Choose a strong password or key and do not reuse weak secrets.
- Encrypt a small test message first.
- Copy the full output, including any salt or IV data the tool provides.
- Decrypt the result immediately to confirm the workflow.
- Store the key separately from the encrypted text.
- Do not treat encryption as a replacement for access control.

The tool saves time, but the important part is still understanding the input and reviewing the output before using it somewhere important.