H
ey Devs 👋

Imagine an Angular application submitting sensitive customer data to a Node.js API. Do we wish to steal that data?

HTTPS encrypts the network connection, but your application may have an additional requirement to encrypt selected payloads before they reach the API layer. That introduces a cross-runtime problem: the browser and backend must agree on the algorithm, key, initialisation vector, ciphertext encoding, and authentication tag.

Not a Medium member? You can read the full article for free by clicking here. 🔗

Using different libraries is not the main challenge. Designing the encryption protocol and managing the key safely are.

For this example, we’ll use AES-256-GCM, an authenticated encryption mode that provides confidentiality and detects tampering.

Encryption inside Angular does not automatically make data secure from someone who controls the browser. A shared AES key embedded in JavaScript can be extracted. The implementation below demonstrates cryptographic interoperability; its shared-key arrangement is for controlled testing, not a production secret-management strategy.

1. How AES-256-GCM works

AES is a symmetric algorithm, meaning encryption and decryption use the same key. AES-256 uses a 256-bit key.