A high-fidelity desktop application built using JavaFX and the Java Cryptography Architecture (JCA) that enables secure text and file encryption/decryption using the industry-standard AES-GCM (256-bit) algorithm with password-based key derivation (PBKDF2). Designed as a professional, educational, and defensive cybersecurity tool.
Imagine writing a secret note to a friend. If anyone reads it on the way, the secret is out. To protect it, you convert it into a scrambled, unreadable message (Ciphertext) using a secret code (Key). Only your friend, who knows the secret code, can convert the scrambled message back into the original note (Plaintext).
This tool does exactly that for your files and text messages on your computer. It provides a visual screen (GUI) where you type text or select a file, type in a password, and click a button to lock (Encrypt) or unlock (Decrypt) your data.
This application is a local-only cryptographic tool that utilizes the Java Cryptography Extension (JCE). It implements Authenticated Encryption with Associated Data (AEAD) via the AES-GCM-NoPadding algorithm. To handle user-supplied human-readable passwords safely, it implements a Key Derivation Function (KDF) namely PBKDF2WithHmacSHA256 to compute a cryptographically strong 256-bit symmetric key. For text operations, the ciphertext and initial vector (IV) are encoded into standard Base64 text representation, ensuring data integrity during transport. File operations are performed in-memory or streamed via Java NIO to handle large binary file encryption securely without corrupting headers.
+-------------------------------------------------------------+
| USER INTERFACE |
| [ Plaintext Input ] [ File Selection ] [ Password Field ]|
+------------------------------+------------------------------+
| (User inputs trigger action)
v
+-------------------------------------------------------------+
| PROCESSING MODULE |
| 1. Validate Input Data & Paths (InputValidator) |
| 2. Derivate 256-bit Key from Password (PBKDF2) |
| 3. Generate 12-byte secure random IV |
| 4. Encrypt/Decrypt data via Cipher class (AES-GCM) |
| 5. Encode/Decode to Base64 (for text) or read/write NIO |
+------------------------------+------------------------------+
| (Output generated)
v
+-------------------------------------------------------------+
| OUTPUT MODULE |
| [ Ciphertext/Plaintext Area ] [ Status Message Bar ] |
| [ Encrypted/Restored File ] [ Success / Error Styles ]|
+-------------------------------------------------------------+
- Practical Demonstration of Cryptography: Moving beyond simple Caesar ciphers to modern, production-grade symmetric encryption (AES-GCM).
- Robust Multi-threaded UI: Running crypto operations asynchronously ensures the UI never freezes during large file encryption.
- Responsive Visual Design: Uses pure JavaFX CSS styling to prove that Java desktop applications can look as clean and modern as web apps.
- Strong Object-Oriented Principles: Demonstrates clean encapsulation, custom exception structures, and logical segregation of UI and business layers.
In professional software development, cryptographic concepts are foundational. Below is how the concepts implemented in this tool relate to production systems:
- Secure Messaging Apps (e.g., Signal, WhatsApp): Use symmetric key algorithms to encrypt message contents. While they use complex key agreement protocols (like Double Ratchet), the actual encryption is performed using symmetric algorithms like AES.
- Banking Software: Relies on strong block ciphers to secure financial transactions and customer data at rest.
- Password Managers (e.g., Bitwarden, 1Password): Use PBKDF2 (often with tens of thousands of iterations) to derive a master key from user master passwords to decrypt the local vaults.
- Cloud Storage & File Systems (e.g., Google Drive, AWS S3): Implement encryption-at-rest using AES-256 GCM to ensure server compromises do not expose file contents.
- Healthcare Systems (HIPAA): Regulated systems require electronic medical records (EMR) to be encrypted at rest and in transit.
- Enterprise Integration: API tokens, database passwords, and connection strings are encrypted in configuration files using symmetric key utilities similar to this application.
Java remains a dominant force in corporate backends, banking platforms, and cloud infrastructure:
- Enterprise Maturity: The JCA (Java Cryptography Architecture) has undergone decades of security hardening.
- Built-in Security Provider Manager: Java handles low-level crypto implementations securely through native configurations (e.g., SunJCE provider).
- Cross-Platform Compatibility: Java's "Write Once, Run Anywhere" allows the exact same secure code to run on a developer's Windows machine, a client's Mac, and a secure Linux backend server.
- Language: Java SE 17
- GUI Framework: JavaFX (v17+) with custom CSS for high-end styling.
- Cryptographic Core:
- Cipher: Advanced Encryption Standard in Galois/Counter Mode (AES-GCM-NoPadding).
- Key Derivation: Password-Based Key Derivation Function 2 with HMAC-SHA256 (PBKDF2WithHmacSHA256) over 65,536 iterations.
- Key Size: AES-256 (256-bit key length).
- IV Generator:
SecureRandomgenerating unique 12-byte initialization vectors per cipher execution.
- Data Formatting: Base64 encoding for textual cipher input/output.
- File Handling: Java NIO (Non-blocking I/O) (
java.nio.file.Filesandjava.nio.file.Path) for efficient, secure file system streams. - Difficulty Rating: Intermediate-Advanced (requires understanding of cryptographic theory, IV/Nonce reuse limits, thread pools, and UI lifecycle).
- Security Limitations:
- Does not perform network key exchange.
- Key length is limited to 256 bits (standard).
- Symmetric-only (sender and receiver must share the same password).
- Encapsulation: State variables like keys, files, and configuration properties are strictly kept private. Access is limited through controlled methods, protecting sensitive variables from memory leaks.
- Custom Exception Handling: We extend standard Java exceptions to create
CryptoExceptionclasses, hiding low-level details (like cryptographic stack traces) and presenting clean, sanitized security warnings to the user.
- Stage & Scene: The foundation of the visual interface.
- Node Hierarchy: Layout panels (
VBox,HBox,GridPane) organize text controls, buttons, status displays, and form headers. - CSS Integration: Leverages JavaFX's
.csssupport for design systems (gradients, rounded buttons, micro-interactions, responsive sizing).
- AES-GCM Mode: An authenticated encryption algorithm. Unlike older modes (like CBC), GCM provides both confidentiality and integrity/authenticity via an authentication tag (AEAD). If a single bit of the encrypted file is altered, decryption will fail, preventing tampering.
- Initialization Vector (IV): A unique, cryptographically random 12-byte number generated for every encryption. It ensures that encrypting the same text twice with the same password results in completely different ciphertext, defeating pattern analysis.
- PBKDF2 Key Derivation: Standard passwords (e.g., "P@ssword123") have low entropy and can be easily brute-forced. PBKDF2 slows down brute-force attacks by hashing the password repeatedly with a salt, turning a weak user password into a high-entropy 256-bit key.
- Base64 Encoding: Encrypted output consists of raw binary bytes that contain control characters. Base64 translates binary data into a set of 64 printable characters, allowing the ciphertext to be easily copy-pasted into text files or emails without corruption.
The application is structured into distinct modules to enforce separation of concerns and ease of maintenance:
+---------------------------------------------------------------------------------+
| 1. INPUT MODULE |
| - Plaintext Area: String Input |
| - Ciphertext Area: Base64 String Input |
| - Key Input: PasswordField (character array) |
| - File Picker: File path via FileChooser |
+----------------------------------------+----------------------------------------+
|
v
+---------------------------------------------------------------------------------+
| 2. PROCESSING MODULE |
| - InputValidator: Validates file existence, text length, and password rules. |
| - KeyDerivation: Converts char[] password to AES SecretKey using PBKDF2. |
| - AESGCMEncryptor: Implements Cipher initialization, IV generation, |
| GCMParameterSpec configuration, and byte encryption/decryption. |
| - FileService: Reads source files via NIO, coordinates encryption, writes |
| combined IV + Tag + Ciphertext payload to destination file. |
+----------------------------------------+----------------------------------------+
|
v
+---------------------------------------------------------------------------------+
| 3. OUTPUT MODULE |
| - Text Panel: Populates results (Base64 ciphertext or decrypted plaintext). |
| - File System: Generates .enc (encrypted) or restored target files. |
| - Status Bar: Employs CSS classes to display success or cryptographic errors. |
+---------------------------------------------------------------------------------+
+------------------+ +------------------+ +------------------+
| Main (App) | -------->| Controller | -------->| InputValidator |
+------------------+ +--------+---------+ +------------------+
|
+--------------------+
| |
v v
+--------+---------+ +-------+----------+
| FileService | | KeyDerivation |
+--------+---------+ +-------+----------+
| |
v |
+--------+---------+ |
| AESGCMEncryptor |<---------+
+--------+---------+
|
v
+--------+---------+
| CryptoException |
+------------------+
[User Input Text/File] ---> [Validate Inputs] ---> [Derive 256-bit Secret Key (PBKDF2)]
|
v
[Generate 12-byte IV] <--- [Initialize Cipher in ENCRYPT Mode] <--+
|
v
[Perform AES-GCM Crypto] ---> [Combine IV + Ciphertext/Tag] ---> [Base64 Encode or Save to File]
[User Input Ciphertext/File] ---> [Validate Inputs] ---> [Derive 256-bit Secret Key (PBKDF2)]
|
v
[Extract 12-byte IV from Payload] ---> [Initialize Cipher in DECRYPT Mode]
|
v
[Verify Tag & Decrypt AES-GCM] -------> [Output Plaintext String / Restored File]
Our step-by-step roadmap for building the tool is as follows:
- Objective: Configure Maven build file, build settings, and target directories.
- Tasks: Establish Maven POM dependencies, project folder structure, and Git control files.
- Expected Output: Compiling Maven configuration resolving standard JavaFX bindings.
- Common Mistakes: Mismatching Java JDK version with compilation configurations.
- Verification: Executing
mvn clean compilewithout errors.
- Objective: Construct user interface structure with responsive styling.
- Tasks: Write FXML or programmatic layout and customize via
modern.cssusing slate backgrounds, custom gradients, rounded corners, and focus states. - Expected Output: The UI loads and shows buttons, labels, and text boxes.
- Common Mistakes: Hardcoded padding sizes and layout constraints that don't scale.
- Verification: Launching GUI and testing resizing behavior.
- Objective: Capture UI events and bind inputs safely.
- Tasks: Connect click events to Java handlers, capture password input, and sanitize empty inputs.
- Expected Output: Clicking buttons triggers validation logic and updates UI messages.
- Common Mistakes: Reading password as a mutable
Stringinstead ofchar[](exposes passwords in memory heap). - Verification: Triggering button clicks with empty fields displays validation errors.
- Objective: Build PBKDF2 and AES-GCM utility routines.
- Tasks: Implement
KeyDerivationclasses andAESGCMEncryptorroutines. - Expected Output: Low-level cryptographic methods pass standard test-vectors.
- Common Mistakes: Reusing the same Initialization Vector (IV) across ciphers (destroys GCM security).
- Verification: Verify that the generated cipher bytes can be decrypted back to the original plaintext.
- Objective: Support encrypting and decrypting files of any type.
- Tasks: Connect Java NIO file read/write operations to the core cipher engine.
- Expected Output: Files (images, PDFs, documents) are encrypted to
.encand restored cleanly. - Common Mistakes: Corrupting file headers or using slow byte-by-byte file I/O.
- Verification: Open a restored image file and ensure it is not corrupt.
- Objective: Make the application robust against tampering and incorrect passwords.
- Tasks: Add try-catch blocks for AEAD decryption authentication failures and wrong passwords.
- Expected Output: Inputting a wrong password shows a "Decryption failed: Incorrect key or corrupted file" error instead of crashing.
- Common Mistakes: Printing cryptographic stack traces (which can leak key metadata) to the user.
- Verification: Attempt decrypting with an incorrect password and confirm a clean error state.
Encryption-Decryption-Tool-Java-GUI/
├── src/
│ ├── gui/ # GUI Controllers and UI views
│ │ └── Controller.java
│ ├── crypto/ # Core AES and Cipher implementations
│ │ └── AESGCMEncryptor.java
│ ├── service/ # File read/write processing services
│ │ └── FileService.java
│ ├── utility/ # Key derivation and validation helper tools
│ │ ├── KeyDerivation.java
│ │ └── InputValidator.java
│ ├── exception/ # Custom application exceptions
│ │ └── CryptoException.java
│ └── main/ # Main runner and application initialization
│ └── Main.java
├── resources/
│ └── styles/ # Modern CSS stylesheets for styling JavaFX views
│ └── modern.css
├── sample_files/ # Directory containing test files before encryption
│ └── .gitkeep
├── encrypted_files/ # Directory populated with encrypted outputs (.enc)
│ └── .gitkeep
├── decrypted_files/ # Directory populated with decrypted output results
│ └── .gitkeep
├── outputs/ # Saved text files
│ └── .gitkeep
├── screenshots/ # Workspace screenshot storage
│ └── .gitkeep
├── docs/ # Additional documentation
│ └── .gitkeep
├── README.md # Comprehensive documentation
├── .gitignore # Git file excludes list
└── pom.xml # Maven build descriptor
- Modern Graphical Interface: Clean layout built with JavaFX.
- Plaintext Input Area: A large
TextAreawhere users can enter plaintext for encryption. - Ciphertext Output Area: Displays the Base64-encoded encrypted text.
- Password / Secret Key Entry: A secure
PasswordFieldthat masks characters. - Action Buttons: Large, clear buttons labeled Encrypt and Decrypt with distinct accent colors.
- Copy to Clipboard: A quick action button to copy the ciphertext immediately.
- Clear Fields: One-click action to clear all text inputs, passwords, and reset the application state.
- Visual Status Messages: A label that shows success or error messages.
- AES-GCM (256-bit): Implements AEAD authenticated encryption.
- Safe Password Derivation: Implements PBKDF2WithHmacSHA256.
- FileChooser Integration: Opens native file pickers for selecting target files.
- File Encryption & Decryption: Encrypts files of any type (PDFs, images, ZIPs) to
.encformat and restores them. - Password Visibility Toggle: Allows users to show or hide their password.
- Input Validation Checks: Warns the user if fields are empty or if the password is too short.
- Caesar Cipher Mode: An educational toggle to see how ancient, weaker encryption worked compared to modern AES-GCM.
- Drag-and-Drop Area: Allows users to drag files directly into the window to select them.
- Theme Selection: Toggle between Dark Mode and Light Mode.
- Password Strength Indicator: Dynamically color-codes password strength.
- Self-Contained Executable: Builds a runnable
.jarfile using the Maven shader plugin.
- Repository Name:
encryption-decryption-tool-java-gui - Description:
A modern JavaFX desktop application for secure, authenticated text and file encryption using AES-GCM-256 and PBKDF2 password hashing. - GitHub Tags / Topics:
java,javafx,cryptography,aes-gcm,cybersecurity,pbkdf2,file-security,educational-tool
- Never upload real encryption keys or passwords.
- Never upload private files. Use the provided dummy files in the
sample_files/directory. - Keep target builds and IDE project settings out of Git using the
.gitignorerules.
feat: initial project structure, maven build config and .gitignore setupfeat: add modern custom CSS styling system for JavaFX componentsfeat: implement Main layout and UI event controller skeletonsfeat: implement PBKDF2 key derivation and input validator routinesfeat: implement core AES-GCM-256 encryption and decryption enginefeat: implement file read/write binary stream encryption servicesfix: resolve tag exception and add wrong password error handlingdocs: finalize README, project setup guides, and walkthroughs
- Java Development Kit (JDK): Version 17 or higher.
- Apache Maven: Installed and added to your system path.
- Navigate to the root directory:
cd Encryption-Decryption-Tool-Java-GUI - Build the project:
mvn clean compile
- Run the JavaFX Application:
mvn javafx:run
- Open IntelliJ, select Open, and navigate to the project directory.
- Select
pom.xmland open as a project. Let Maven download dependencies. - Navigate to
src/main/Main.java. Right-clickMain.javaand select Run 'Main.main()'.
- Choose File -> Import -> Existing Maven Projects.
- Select the root directory and click Finish.
- Right-click the project -> Run As -> Maven build... with goal
javafx:run.
To show your development progress on GitHub, follow this 8-day schedule. Each day is a separate commit:
- Commit Message:
feat: setup Maven configuration, folder structure, and .gitignore - Files:
pom.xml,.gitignore, empty folder directories with.gitkeep. - Proof to Capture: Screenshot of the directory structure in your IDE.
- Commit Message:
feat: create custom modern CSS styles and GUI controllers - Files:
resources/styles/modern.css,src/main/Main.java,src/gui/Controller.java. - Proof to Capture: Screenshot of the GUI window opening with styling applied (buttons, text fields, headers).
- Commit Message:
feat: setup exception structure and core crypto class skeletons - Files:
src/exception/CryptoException.java,src/crypto/AESGCMEncryptor.java. - Proof to Capture: File listing view showing the custom exceptions and empty class structures.
- Commit Message:
feat: implement PBKDF2 key derivation and input validation - Files:
src/utility/KeyDerivation.java,src/utility/InputValidator.java. - Proof to Capture: Standard test runs showing a character array password being successfully converted to an AES key.
- Commit Message:
feat: implement AES-GCM encryption and decryption logic for text - Files:
src/crypto/AESGCMEncryptor.java(implemented). - Proof to Capture: Screenshot of the GUI showing plaintext in the input area, clicking Encrypt, and generating Base64 ciphertext in the output area.
- Commit Message:
feat: implement NIO file streams for binary encryption - Files:
src/service/FileService.java(implemented). - Proof to Capture: Folder screenshot showing a PDF file in
sample_files/and the resulting encrypted.encfile inencrypted_files/.
- Commit Message:
fix: implement AEAD tag validation and user input error popups - Files:
src/gui/Controller.java(updated),src/exception/CryptoException.java. - Proof to Capture: Screenshot of the UI displaying a red "Incorrect Key" error after trying to decrypt with the wrong password.
- Commit Message:
docs: update documentation, instructions, and finalize README - Files:
README.md,docs/*. - Proof to Capture: GitHub repository home screen displaying the formatted README document.
Below is the list of screenshots to capture and save in your screenshots/ directory to document your work:
- Project Directory Structure: Screenshot of your IDE showing the clean package structure (
gui,crypto,service,utility,exception,main). - Home GUI Screen: The styled JavaFX window showing the input areas, sliders, file pickers, and modern dark-mode colors.
- Plaintext Input: The UI containing sample text in the input area and the password field filled out.
- Successful Encryption: The UI with Base64 ciphertext populated in the output box and a green "Text Encrypted Successfully" banner.
- Successful Decryption: The ciphertext decrypted back to plaintext, showing a green "Text Decrypted Successfully" banner.
- Incorrect Password Error: A red banner showing "Decryption Failed: Bad Tag / Wrong Password" after typing an invalid decryption password.
- FileChooser Prompt: The open file picker window selecting a sample image or document.
- Encrypted File Generation: Directory view of
encrypted_files/showing a generated.encfile. - Decrypted File Recovery: Directory view of
decrypted_files/showing the recovered file, and double-clicking it to prove it opens without corruption. - Validation Warning: A yellow/red popup warning showing "Password must be at least 8 characters long".
Warning
This application is built strictly for educational, academic, and defensive cybersecurity training purposes.
The code is designed to demonstrate cryptography principles in a clear, readable manner. While it uses secure algorithms (AES-GCM-256), it does not protect against advanced operating system threats, such as memory extraction, process monitoring, or keylogging malware. Do not use this application to store high-value commercial secrets or protect critical personal health information without understanding local machine vulnerabilities.
- Student Developer: Sufiyan
- Course: Java Programming / Defensive Cybersecurity
- Academic Year: 2026