AES Decryption Tool
Decrypt AES-128/192/256 ciphertext: OpenSSL "Salted__" (U2FsdGVkX1…) data, CryptoJS output, or raw hex key + IV in CBC, GCM, CTR, CFB, OFB, ECB.
Output uses the OpenSSL "Salted__" format in Base64: an 8-byte random salt followed by the ciphertext. Key and IV are derived from the passphrase and the salt, so the same text gives a different result every time. Equivalent command:
openssl enc -aes-256-cbc -d -md md5 -a -A -k '…'Runs entirely in your browser. Your data is never uploaded.
What is AES Decryption?
Decrypts AES ciphertext in the browser. It reads the OpenSSL "Salted__" format (Base64 strings starting with U2FsdGVkX1) produced by openssl enc and CryptoJS.AES.encrypt(text, passphrase), or raw ciphertext with a hex key and IV in CBC, CFB, CTR, OFB, ECB or authenticated GCM mode. Padding is verified, so a wrong key is reported instead of returning garbage.
How to use AES Decryption
- Select the same Key source that was used to encrypt: Passphrase (OpenSSL-compatible) for
U2FsdGVkX1…("Salted__") data, or Raw key + IV (hex) for raw ciphertext. - Enter the passphrase (and the same Key derivation), or the hex key and IV.
- Set the same Mode and Padding as the sender and paste the Ciphertext (Base64 or Hex).
- Click Decrypt. Keep the output as Text (UTF-8), or switch to Hex if the plaintext is binary.
Example
U2FsdGVkX19HHh9Vv809WnL0M8IWPgnpihePLw8JpDQ= (passphrase "secret", AES-256, CBC, EVP_BytesToKey MD5)
Hello, World!
Ciphertext produced by openssl enc -aes-256-cbc -md md5 -a -k secret.
When to use AES Decryption
Use it to read data encrypted with OpenSSL or CryptoJS, to debug why your application cannot decrypt something, or to check test vectors. You need the correct passphrase or key – the tool cannot recover lost keys or break AES. If the ciphertext came from another product (a ZIP, a database, a password manager) it usually has its own container format and will not decrypt here.
How AES Decryption works
For passphrase data the first 16 bytes must be Salted__ plus an 8-byte salt. The key and IV are re-derived from passphrase and salt with EVP_BytesToKey (MD5) or PBKDF2-HMAC-SHA256 with your iteration count, exactly as openssl enc -d does, then the rest is decrypted. With a raw key the hex key and IV are used directly. After CBC/ECB decryption the PKCS#7 padding is checked byte by byte – a mismatch almost always means a wrong key, IV, mode or key size. In GCM the 16-byte tag at the end is verified by Web Crypto before any plaintext is shown.
Common Use Cases
- Decrypt a
U2FsdGVkX1…string fromopenssl enc -aes-256-cbc -a - Check a value encrypted by
CryptoJS.AES.encryptin a web app - Verify AES-GCM ciphertext + tag produced by your backend
- Find out which key size or mode was used by trying the likely settings
- Decrypt test data during API or integration debugging
Security Note
Decryption happens locally; passphrases and plaintext never leave your device. Only GCM proves that the data was not modified.
FAQs
What does "Invalid padding" or "wrong passphrase" mean?
The decrypted last block did not end in valid PKCS#7 padding. Check the passphrase, the key size (128/192/256), the mode and the key derivation (MD5 vs PBKDF2 and its iterations). OpenSSL 1.1+ defaults to -md sha256 without -pbkdf2, which is not supported here – re-encrypt with -md md5 or -pbkdf2.
Can it decrypt output of CryptoJS?
Yes. CryptoJS.AES.encrypt(text, "passphrase").toString() uses the same Salted__ format with AES-256-CBC and EVP_BytesToKey/MD5, which is the default setting here.
My ciphertext does not start with U2FsdGVkX1. What now?
Then it was encrypted with a raw key. Switch Key source to Raw key + IV (hex) and enter the key and IV that the program used. Some programs prepend the IV to the ciphertext; split it off and enter it in the IV field.
Why does decryption output look like random characters?
In stream modes (CTR, CFB, OFB) there is no padding to verify, so a wrong key produces random bytes. The tool reports them as invalid UTF-8; switch the output to Hex if you expect binary data.