java 45 lines · 7 steps

Authenticated encryption with AES-GCM in Java

A small helper that encrypts and decrypts strings using AES-GCM, packing the random IV alongside the ciphertext.

Explained by highlit

Intermediate cryptography aes-gcm authenticated-encryption base64 byte-buffer

1public final class AesGcmCipher {
2 
  private static final String TRANSFORMATION = "AES/GCM/NoPadding";
  private static final int GCM_TAG_BITS = 128;
  private static final int IV_LENGTH = 12;
6 
  private final SecretKey key;
  private final SecureRandom random = new SecureRandom();
9 
  public AesGcmCipher(SecretKey key) {
      this.key = key;
  }
13 
  public String encrypt(String plaintext) throws GeneralSecurityException {
      byte[] iv = new byte[IV_LENGTH];
      random.nextBytes(iv);
17 
      Cipher cipher = Cipher.getInstance(TRANSFORMATION);
      cipher.init(Cipher.ENCRYPT_MODE, key, new GCMParameterSpec(GCM_TAG_BITS, iv));
      byte[] ciphertext = cipher.doFinal(plaintext.getBytes(StandardCharsets.UTF_8));
21 
      byte[] combined = ByteBuffer.allocate(iv.length + ciphertext.length)
              .put(iv)
              .put(ciphertext)
              .array();
      return Base64.getEncoder().encodeToString(combined);
  }
28 
  public String decrypt(String encoded) throws GeneralSecurityException {
      byte[] combined = Base64.getDecoder().decode(encoded);
      if (combined.length <= IV_LENGTH) {
          throw new IllegalArgumentException("Malformed ciphertext");
      }
34 
      ByteBuffer buffer = ByteBuffer.wrap(combined);
      byte[] iv = new byte[IV_LENGTH];
      buffer.get(iv);
      byte[] ciphertext = new byte[buffer.remaining()];
      buffer.get(ciphertext);
40 
      Cipher cipher = Cipher.getInstance(TRANSFORMATION);
      cipher.init(Cipher.DECRYPT_MODE, key, new GCMParameterSpec(GCM_TAG_BITS, iv));
      return new String(cipher.doFinal(ciphertext), StandardCharsets.UTF_8);
  }
45}

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1GCM needs a fresh random IV for every encryption, so a shared key stays secure across many messages.
2Prepending the IV to the ciphertext lets you decrypt later with no separate metadata to track.
3The 128-bit GCM tag provides integrity, so tampered ciphertext fails to decrypt instead of returning garbage.

Related explainers

java

@Component
@Converter
public class EncryptedStringConverter implements AttributeConverter<String, String> {

Transparent column encryption in Spring & JPA

encryption aes-gcm jpa-converter

Advanced 10 steps

java

package com.acme.billing.config;
 
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.context.properties.ConfigurationProperties;

Feature-flagged beans with Spring @ConditionalOnProperty

feature-flags conditional-beans strategy-pattern

Intermediate 5 steps

java

public static Map<String, String> parseCookieHeader(String header) {
    Map<String, String> cookies = new LinkedHashMap<>();
    if (header == null || header.isBlank()) {
        return cookies;

Parsing an HTTP Cookie header in Java

string-parsing http url-decoding

Intermediate 6 steps

java

public class TimedSocketReader {
 
    private static final int READ_TIMEOUT_MS = 5_000;
    private static final int CONNECT_TIMEOUT_MS = 3_000;

Reading a socket with connect and read timeouts

sockets timeouts io

Intermediate 8 steps

java

public final class EncodingDetector {
 
    public enum Encoding {
        UTF_8, UTF_16LE, UTF_16BE, UTF_32LE, UTF_32BE, ASCII, UNKNOWN

Detecting text encoding from raw bytes in Java

byte-manipulation encoding-detection bitwise-operations

Intermediate 8 steps

java

public final class ImportOrganizer {
 
    private static final Pattern IMPORT_LINE =
            Pattern.compile("^import\\s+(static\\s+)?([\\w.]+(?:\\.\\*)?)\\s*;\\s*$");