AES key wrap (RFC 3394)
Wrap a raw key under a key-encrypting key (AES-KW), on your device.
Runs on your device. The file is never uploaded.
AES key wrap (RFC 3394) encrypts the bytes of a small file under a hex key-encrypting key of 16, 24 or 32 bytes. The wrapped result prints as hex, 8 bytes longer than the input. A payload under 16 bytes, or one that is not a multiple of 8, is refused.
Questions
What does AES key wrap do that AES-GCM encrypt does not?
It encrypts a key rather than a file, and it is deterministic. AES-KW is RFC 3394: given the same key-encrypting key and the same input bytes it always produces the same wrapped output, with no salt and no IV. That suits storing or moving raw key material. For a document or an archive use AES-GCM encrypt instead, which is randomized and authenticated per message.
What can the KEK be?
A hex string of 16, 24 or 32 bytes, meaning 32, 48 or 64 hex characters. Anything else is refused with "kek must be 16, 24, or 32 bytes (32/48/64 hex chars)". If the text is not hex at all, or has an odd number of digits, you get "must be a hex string with an even number of digits" first. The tool does not derive a KEK from a password; you supply the raw bytes.
What can I wrap?
Any file at least 16 bytes long whose length is a multiple of 8. Otherwise it refuses with "key to wrap must be at least 16 bytes and a multiple of 8". That is the RFC 3394 rule, not an AES key size rule, so a 40-byte HMAC key wraps fine. The payload is imported internally as an HMAC key precisely so lengths other than 16, 24 and 32 are accepted.
What is the output?
Hex text on the page, not a file. AES-KW prepends an integrity check value, so the wrapped result is 8 bytes longer than what you put in. Copy the hex and feed exactly that to AES key unwrap with the same KEK to get the original bytes back. There is no header, no label and no record of what the wrapped key was for.
Does my KEK go anywhere?
No. Everything runs in a Web Worker in this tab through crypto.subtle. The KEK is imported as a non-extractable AES-KW key inside the page, used once, and discarded when the run ends. Nothing is uploaded, nothing is stored between runs, and the site keeps working with the network off.
Does wrapping protect the key from someone who has the KEK?
No, and it is not meant to. AES-KW protects wrapped key material from anyone who does not hold the key-encrypting key. Anyone who does hold it unwraps in one step with AES key unwrap. All the security moves to how you store the KEK. Because the wrap is deterministic, an observer can also tell that two wrapped blobs under the same KEK hold the same key.