Blowfish Encryption and Decryption
Encrypt or decrypt with Blowfish (4–56 byte keys) in CBC, CFB, OFB or ECB. OpenSSL bf-cbc passphrase format or raw hex key and IV. Free, in-browser.
Output uses the OpenSSL "Salted__" format in Base64: an 8-byte random salt followed by the ciphertext. Key and IV are derived from the passphrase and the salt, so the same text gives a different result every time. Equivalent command:
openssl enc -bf-cbc -md md5 -a -A -provider legacy -provider default -k '…'Runs entirely in your browser. Your data is never uploaded.
What is Blowfish Encrypt & Decrypt?
Encrypts and decrypts data with Blowfish, Bruce Schneier's 1993 block cipher with a 64-bit block and variable key length (4–56 bytes). Use the Encrypt / Decrypt tabs to switch direction, so you can also decrypt your own output or data from OpenSSL bf-cbc.
How to use Blowfish Encrypt & Decrypt
- Choose the Encrypt or Decrypt tab.
- Select Passphrase (OpenSSL-compatible) and type a passphrase, or Raw key + IV (hex) with a 4–56 byte key and an 8-byte IV.
- Choose the Mode and Padding (CBC + PKCS#7 matches OpenSSL bf-cbc).
- Enter the plaintext or ciphertext, click the button and copy the result.
Example
Raw key 0000000000000000, mode ECB, padding None, hex plaintext 0000000000000000
4ef997456198dd78
Schneier's first Blowfish test vector, Hex output.
When to use Blowfish Encrypt & Decrypt
Use it to read or produce data for legacy software that uses Blowfish, or to generate test vectors. Its 64-bit block makes it unsuitable for large amounts of data (Sweet32). For new work use AES. Note that bcrypt password hashes are based on Blowfish but are not encrypted data – they cannot be decrypted here.
How Blowfish Encrypt & Decrypt works
Blowfish expands the key into 18 P-array entries and four 256-entry S-boxes, then runs 16 Feistel rounds on each 8-byte block. Keys of any length from 4 to 56 bytes are cycled byte by byte through the P-array as in the reference implementation (verified with Eric Young's variable-key test vectors). Passphrase mode derives a 16-byte key and 8-byte IV from passphrase and random salt (EVP_BytesToKey MD5 or PBKDF2-SHA256) and writes the OpenSSL Salted__ format compatible with openssl enc -bf-cbc. CBC/ECB use PKCS#7 padding, which is verified on decryption.
Common Use Cases
- Decrypt
openssl enc -bf-cbcoutput - Create Blowfish test vectors with keys of unusual length
- Interoperate with legacy PHP mcrypt or Java Blowfish code
- Teach Feistel ciphers with a classic algorithm
Security Note
Blowfish is not broken, but its 64-bit block is vulnerable to birthday attacks after a few gigabytes under one key. Prefer AES for new data.
FAQs
Can I decrypt with this page?
Yes – click the Decrypt tab, enter the same passphrase or key/IV and settings, and paste the ciphertext.
Can it decrypt a bcrypt hash?
No. bcrypt is a one-way password hash that only uses Blowfish internally; it cannot be decrypted, only verified.
Is the output compatible with OpenSSL?
Yes. In passphrase mode the result is exactly what openssl enc -bf-cbc -md md5 -a -A -k <passphrase> produces (EVP_BytesToKey with MD5), or -pbkdf2 -iter N when you choose PBKDF2-HMAC-SHA256. Add -d to decrypt. The page shows the matching command under the passphrase field.
Which key lengths are allowed?
From 4 to 56 bytes (8 to 112 hex characters). Passphrase mode always derives a 128-bit key, like OpenSSL.