SM4 Encryption & Decryption
Encrypt and decrypt text with SM4, the Chinese national standard.
You'll need it again to decrypt. Nothing you type leaves this page.
OpenSSL's default is 10,000. Any number works: more makes the password slower to guess; decrypting needs the same number.
The usual choice with OpenSSL. Needs an IV; pads to whole blocks.
openssl enc -sm4-cbc -pbkdf2 -iter 10000 -a -AOpenSSL asks for the password; paste the text into it, or add -in and -out files.
SM4, formerly SMS4, is the Chinese national standard block cipher (GB/T 32907-2016), with a 128-bit key and 16-byte blocks; it has also been part of ISO/IEC 18033-3 since 2021. Systems that follow China's commercial cryptography rules use it where others would use AES, for example in banking and government systems. Encrypt and decrypt text with SM4 here in CBC mode by default, or ECB, CTR, CFB or OFB, with a password in the openssl enc -pbkdf2 format or your own 32-digit hex key and IV. SM4 runs in your browser, so the text and key never leave your device, and it's free, with no sign-up.
How to encrypt and decrypt text with SM4
- Choose Encrypt or Decrypt. Type the text to encrypt, or paste the Base64 or hex text to decrypt — the format is detected automatically.
- Enter a password (Generate makes a strong one), or switch to Key & IV (hex) and enter or generate a 32-digit key and a 32-digit IV (ECB has no IV).
- Pick the mode — CBC unless the data was made with another. Turn on No padding only if the data was encrypted without PKCS#7 padding.
- Copy or download the result. Under Same with OpenSSL, the page shows the openssl command that does the same, without your password.
Features
- SM4 (GB/T 32907-2016) with its 128-bit key
- CBC, ECB, CTR, CFB and OFB modes; PKCS#7 padding or none
- Password mode in the openssl enc -pbkdf2 format, readable by openssl enc -sm4-cbc
- The matching openssl command for every mode
- Key & IV mode with a 32-digit hex key and IV, typed or generated
- Base64 or hex in and out; copy, download or Swap the result
Is it private?
Yes. SM4 runs in WebAssembly inside your browser, and the password is stretched by the browser's Web Crypto; your text, password and key are never uploaded or saved.
Frequently asked questions
Is SM4 secure?
Yes. No practical attack on full 32-round SM4 is known, and its 128-bit key gives about the same security as AES-128. As with any cipher here, the password is the weak point — use a long random one.
Can I decrypt it with OpenSSL?
Yes, with OpenSSL 3: echo 'U2FsdGVkX1…' | openssl enc -d -sm4-cbc -pbkdf2 -iter 10000 -a -A (OpenSSL then asks for the password). Use -sm4-ecb, -sm4-ctr, -sm4-cfb or -sm4-ofb for the other modes, and -K <32 hex digits> -iv <32 hex digits> instead of -pbkdf2 -iter in Key & IV mode. If your openssl rejects sm4-cbc, it was built without SM4.
Does it support SM4-GCM?
No. SM4 is offered in CBC, ECB, CTR, CFB and OFB, the modes openssl enc has; none of them detects changes to the text. GCM is available on the AES page.
Can it do SM2 or SM3 too?
No. SM2 is a public-key algorithm and SM3 a hash function; this page does SM4 symmetric encryption only. For hashes, the Hash tool offers MD5 and the SHA family, not SM3.