Padding belongs to a mode's message processing
AES has a 16-byte block size. CBC needs complete blocks and this tool uses PKCS7. GCM and CTR can process partial final blocks without PKCS7. Do not add a padding setting simply because another library's API shows one; it must match the actual mode and protocol.
The password profile fixes GCM and therefore has no PKCS7 selector. Raw CBC displays PKCS7 as its explicit convention. A target using zero padding or no padding is not automatically compatible with that setting.
A byte-level PKCS7 example
For a 13-byte message, PKCS7 appends three bytes with value 03, producing one 16-byte block. If a message is already exactly 16 bytes, PKCS7 adds a full block of sixteen 10 bytes in hexadecimal. That full extra block makes removal unambiguous.
In the raw CBC tool, entering abc uses three UTF-8 bytes. Thirteen 0d padding bytes are added before encryption; the three plaintext bytes are restored after valid PKCS7 removal. Do not manually append those bytes in the editor: the implementation already handles padding.
What a padding error can tell you
A wrong key, wrong IV, wrong mode, modified ciphertext or different padding convention can cause failure. A padding error does not identify which parameter is wrong. Conversely, random wrong-key bytes can occasionally have valid-looking padding, so a successful removal does not authenticate the plaintext.
For GCM, failure is reported as an authentication mismatch and no plaintext is released. Do not switch a damaged GCM package to CBC to bypass that protection. CTR has no padding check and may return bytes without proving anything about integrity.
Troubleshoot without altering the message
Confirm the ciphertext is decoded correctly, the CBC IV is 16 bytes and the key matches its selected size. Retain any required trailing newlines in the original message. If the peer uses another padding convention, use that system's documented implementation rather than stripping zeroes or guessing how much plaintext to delete.
Related tools and reading
- Encrypt text
- Decrypt text
- Encrypt a file
- Generate a key
- What Is AES Encryption? Keys, Blocks and Recovery
- AES-GCM vs CBC vs CTR: Authentication and Parameters
- AES-128 vs AES-192 vs AES-256: Bytes and Encodings
Technical references
Updated October 16, 2026