The same password can produce different ciphertext each time because the password is not the only input that changes. The password is turned into a key with a salt, and each encryption operation receives its own initialization vector (IV), also called a nonce. The line that makes each output unique is the one that supplies a fresh IV to the encrypt call. Use a new, unique IV for every encryption under a given key, store it with the ciphertext, and identical data encrypts to different output. Reuse an IV under the same key, and the protection that AES-GCM provides weakens.
Where the uniqueness actually comes from
No single function call guarantees uniqueness by its syntax. A Web Crypto encryption call has this shape:
As an Amazon Associate I earn from qualifying purchases.
crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, plaintext)
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The key can stay the same from one message to the next. What must change is iv. MDN’s reference for the AesGcmParams dictionary states that the IV “must be unique for every encryption operation carried out with a given key.” The same reference adds that the IV “does not have to be secret, just unique,” so it is acceptable to transmit it in the clear alongside the encrypted message.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Two stages: derive the key, then encrypt
Password-based encryption has two separate steps, and each one has its own inputs.
Stage 1: derivation
The password, a password-based key derivation function (KDF), a salt, and the KDF parameters produce the encryption key. The same password with the same salt and the same parameters always yields the same key. That is why the salt and parameters must be retained: without them, the key cannot be rebuilt later.
Stage 2: encryption
The key, the plaintext, and a unique IV produce the ciphertext. For AES-GCM, the output is authenticated, so modification of the ciphertext is detected at decryption time.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
If a new salt is used for every encryption, each encryption also gets a new key. The IV rule still applies to each key, so a fresh salt does not remove the need for a fresh IV. The two values are not interchangeable.
Salt and IV do different jobs
| Property | Salt | IV (nonce) |
|---|---|---|
| Used in | Deriving the key from the password | The encryption operation itself |
| Uniqueness rule | Unique salts are the standard guidance for password storage; for password-derived encryption, the salt must be retained so the key can be reproduced | Must be unique for every encryption under the same key (MDN) |
| Secret? | Not a secret key | Need not be secret (MDN) |
| Stored with the ciphertext? | Yes, required to re-derive the key | Yes, decryption requires the same IV |
| Standard length | Not stated in the sources reviewed for this article | 96 bits recommended for AES-GCM (MDN) |
A working example
The following sketch uses Web Crypto in a browser or runtime that provides crypto.subtle. It derives an AES-GCM key from a password with PBKDF2, then encrypts with a fresh IV. The iterations value must be set from current guidance for PBKDF2 with SHA-256; the number is a configuration choice, not a constant of the API.
const enc = new TextEncoder();
const salt = crypto.getRandomValues(new Uint8Array(16));
const iv = crypto.getRandomValues(new Uint8Array(12)); // 12 bytes = 96 bits
const material = await crypto.subtle.importKey(
"raw", enc.encode(password), "PBKDF2", false, ["deriveKey"]
);
const key = await crypto.subtle.deriveKey(
{ name: "PBKDF2", salt, iterations, hash: "SHA-256" },
material,
{ name: "AES-GCM", length: 256 },
false,
["encrypt", "decrypt"]
);
const ciphertext = await crypto.subtle.encrypt(
{ name: "AES-GCM", iv }, key, enc.encode(message)
);Decryption repeats the derivation from the same password, salt, and parameters, then uses the same IV:
Rank #3
- USB-C or tap via NFC for easy authentication on any compatible device. No drivers needed; optional Kensington software available for advanced management features.
- Works across Windows, macOS, iOS, Android, ChromeOS, and supports Passkeys and Apple ID.
- Slim, keychain-ready form for easy carry and on-the-go authentication
- IP68-rated for dependable performance
- FIDO CTAP 2.1 for enhanced security features (e.g. resident credentials, Passkey support) and backwards compatibility with CTAP 2. FIDO2 L2 certified security for phishing resistant protection against identity theft and unauthorized access.
const plain = await crypto.subtle.decrypt(
{ name: "AES-GCM", iv }, key, ciphertext
);MDN’s deriveKey() documentation uses the same pattern: a password-derived AES-GCM key using PBKDF2 and a salt, with the same IV supplied to decryption.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhat to store alongside the ciphertext
- The salt used for key derivation.
- The IV used for that encryption operation.
- The KDF name and its parameters, including the iteration count and hash function.
- The ciphertext returned by the encrypt call. In Web Crypto, the AES-GCM authentication tag is appended to the output by default, so it travels with the ciphertext.
The exact storage format is an implementation choice. A common approach is a small record with fixed-length fields, but any format works as long as each value can be recovered at decryption time.
Why reusing an IV is a serious error
For AES-GCM, the IV must not repeat under the same key. Reuse violates the mode’s requirement, and in GCM it damages both confidentiality and authentication, not just one of them. Repetition can be accidental: a counter reset after a restart, two servers generating values from the same state, or a fixed value hard-coded during testing. Uniqueness is the requirement, and it does not depend on the IV being secret.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
When decryption fails
A failed decrypt call usually means one of the stored inputs differs from the one used to encrypt. Check these in order:
- The IV is wrong or missing. The stored value must be the one passed to encryption, byte for byte.
- The salt is wrong or missing. A different salt derives a different key.
- The KDF parameters differ. A changed iteration count or hash function yields a different key, even with the correct password.
- The password differs. A typo or a changed normalization step, such as Unicode form handling, produces a different key.
- The ciphertext was modified. AES-GCM’s authentication check rejects altered data, so a corrupted or tampered record fails rather than decrypting to garbage.
What the same password does not protect
A KDF makes guessing passwords more expensive for someone who has the password-derived ciphertext, but it does not make a weak password strong. Anyone who obtains the ciphertext can attempt guesses offline, and the IV does nothing to slow that down. Use a password with enough entropy, or use a key that is generated randomly and stored in a key-management system instead of being derived from a memorable phrase.
Password-based encryption is also different from storing login passwords. Encryption exists to recover data later, so the password-derived key must be reproducible. Login verification needs no recovery at all. For stored login passwords, the OWASP Password Storage Cheat Sheet recommends a slow password-hashing algorithm with a unique salt, and it does not recommend reversible encryption for this purpose. The Python cryptography documentation recommends Argon2id for deriving a key from a password, which is a different use case from login verification.
Standards and limits of the guidance
The sources cited here establish the uniqueness requirement, the 96-bit IV recommendation, and the need to keep the salt and IV for decryption. They do not give a collision probability for random 96-bit IVs, and they do not set a maximum number of messages per key. For those operational limits, consult the documentation of the library you use and the relevant standard. NIST Special Publication 800-38D specifies GCM and is the reference for its IV and usage constraints.
The safe claim is narrow: with a unique IV for each encryption under a given key, identical plaintexts produce different ciphertexts. The claim does not extend to every possible message, every key, or every system design.
Quick Recap
Practical checklist
- Use a well-maintained library’s authenticated encryption, not a custom cipher.
- Generate a fresh IV for every encryption, and never reuse one under the same key.
- Generate salts randomly, and store each salt with the data it protects.
- Record the KDF name and parameters with the ciphertext.
- Use a strong password or a randomly generated key, and keep login-password storage separate from data encryption.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
