Question 1

How does Fernet provide authenticated encryption?

Accepted Answer

Fernet is a symmetric encryption scheme from Python's cryptography library. It combines AES-128-CBC for encryption with HMAC-SHA256 for authentication. Fernet guarantees that a message encrypted with a given key cannot be manipulated or read without that key — it's tamper-proof authenticated encryption.

Question 2

What is the Fernet key format?

Accepted Answer

A Fernet key is exactly 32 random bytes encoded as URL-safe base64. The first 16 bytes are the signing key (for HMAC), the last 16 bytes are the encryption key (for AES-128-CBC). Keys should be generated using a cryptographically secure random source, as this tool does.

Question 3

Is this Fernet implementation compatible with Python's cryptography library?

Accepted Answer

Yes — this tool follows the Fernet specification (github.com/fernet/spec). Tokens generated here can be decrypted in Python using: from cryptography.fernet import Fernet; f = Fernet(key); f.decrypt(token). Python Fernet tokens can be decrypted here with the same key.

Question 4

Does Fernet include a timestamp?

Accepted Answer

Yes — every Fernet token includes an 8-byte timestamp of when it was encrypted. Python's Fernet.decrypt() supports a ttl parameter to reject tokens older than a specified number of seconds. This tool doesn't enforce TTL but you can inspect the token to see when it was created.

Question 5

How does Fernet compare to AES-GCM?

Accepted Answer

Fernet uses AES-CBC+HMAC while modern tools prefer AES-GCM (which is simpler and slightly faster). Both provide authenticated encryption. Fernet is primarily used in Python applications. For new non-Python systems, AES-256-GCM is the preferred choice.

Question 6

What is Fernet encryption?

Accepted Answer

Fernet is a symmetric encryption standard from the Python cryptography library. It combines AES-128-CBC encryption with HMAC-SHA256 authentication and includes a timestamp, making it self-describing and authenticated. Fernet tokens are Base64-encoded and contain the encrypted data, IV, and HMAC signature. It's commonly used in Python applications for encrypting configuration values and session data.

Question 7

When should I use Fernet vs AES directly?

Accepted Answer

Fernet is a safe default for Python applications — it handles IV generation, HMAC authentication, and timestamp validation automatically, preventing common mistakes. Use raw AES via DevDecode's AES Encrypt/Decrypt when you need cross-language compatibility, custom modes (GCM), or specific performance requirements. For non-Python environments, AES-256-GCM provides similar authenticated encryption.

Fernet Encrypt/Decrypt — Free Online Fernet Encryption Tool

Frequently Asked Questions

Fernet: Authenticated Symmetric Encryption for Python Applications

Related Tools

AES Encrypt/Decrypt

Text Encrypt/Decrypt

HMAC Generator

Password Generator