JSONToTable

Loading AES Key Wrap/Unwrap Tool...

How to Use AES Key Wrap/Unwrap Tool

Protect and transport key material using KEK-based wrapping with RFC 3394 compliance.

Step 1

Choose Wrap or Unwrap Operation

Select Wrap when you need to protect plaintext key bytes for transport, or Unwrapto restore original key bytes from wrapped input. AES-KW specification is defined in RFC 3394.

Example Input (Plain Key to Wrap)

00112233445566778899aabbccddeeff
Step 2

Set KEK (Key Encryption Key)

Provide KEK as HEX using AES-128 or AES-256 length. KEK is separate from the key material being wrapped. This separation is a core key management pattern used in HSM and KMS pipelines. For key generation, use AES Key & IV Generator and follow OWASP crypto storage guidance.

Step 3

Validate Wrapped Output

Wrapped output can be produced in HEX or Base64 for API transport. During unwrap, this tool verifies the RFC 3394 integrity value. If integrity check fails, key bytes or KEK are incorrect.

Known RFC 3394 Wrapped Result

1fa68b0a8112b447aef34bd8fb5a7b829d3e862371d2cfe5
Step 4

Use in Key Management Workflows

Use wrapped values when moving keys between services without exposing plaintext key bytes in transit. Pair this with OpenSSL AES tools, PBKDF2 key derivation, and your KMS rotation policy.

Frequently Asked Questions

What is AES Key Wrap?

AES Key Wrap is a standardized algorithm for protecting key material using a KEK without treating it like regular data encryption.

Why does unwrap fail integrity check?

It usually means wrong KEK, corrupted wrapped value, or non-RFC3394 wrapped input.

Can I wrap any length key material?

This page supports RFC3394 input lengths that are multiples of 8 bytes and at least 16 bytes.

Is wrapped data same as encrypted file?

No. Key wrap is specifically designed for wrapping keys, not general file/message encryption.

Should KEK be stored with wrapped key?

No. KEK must be protected separately, typically in KMS/HSM or dedicated secret management systems.

Where is AES-KW commonly used?

It is widely used in enterprise key management, cloud KMS integrations, and inter-service key exchange workflows.

Related Tools

AES Encryption

AES encryptor online - Encrypt text, JSON, and files with AES-128 or AES-256. Support for CBC, GCM, and CTR cipher modes. Military-grade encryption with automatic key generation.

AES Decryption

AES decryptor online - Decrypt AES-encrypted data with AES-128 or AES-256. Support for CBC, GCM, and CTR modes. Restore your encrypted files securely.

AES Key & IV Generator

Generate secure AES-128 or AES-256 encryption keys and initialization vectors (IV) in hex or Base64 format.

AES-GCM Encrypt/Decrypt

Encrypt and decrypt data specifically in AES-GCM mode with AES-128 or AES-256 and Base64 ciphertext output.

AES-CBC Encrypt/Decrypt

Encrypt and decrypt data specifically in AES-CBC mode with AES-128 or AES-256 and Base64 ciphertext output.

AES-CTR Encrypt/Decrypt

Encrypt and decrypt data specifically in AES-CTR mode with AES-128 or AES-256 and Base64 ciphertext output.