DES Decryption (Legacy)
Decrypt legacy DES ciphertext: OpenSSL des-cbc Salted__ data with a passphrase, or raw data with an 8-byte hex key and IV. Padding is verified locally.
Output uses the OpenSSL "Salted__" format in Base64: an 8-byte random salt followed by the ciphertext. Key and IV are derived from the passphrase and the salt, so the same text gives a different result every time. Equivalent command:
openssl enc -des-cbc -d -md md5 -a -A -provider legacy -provider default -k '…'Runs entirely in your browser. Your data is never uploaded.
What is DES Decryption?
Decrypts data that was encrypted with single DES – for example files from old systems or values produced with openssl enc -des-cbc. It accepts the OpenSSL Salted__ Base64 format with a passphrase or raw ciphertext with a hex key and IV.
How to use DES Decryption
- Select the same Key source that was used to encrypt: Passphrase (OpenSSL-compatible) for
U2FsdGVkX1…("Salted__") data, or Raw key + IV (hex) for raw ciphertext. - Enter the passphrase (and the same Key derivation), or the hex key and IV.
- Set the same Mode and Padding as the sender and paste the Ciphertext (Base64 or Hex).
- Click Decrypt. Keep the output as Text (UTF-8), or switch to Hex if the plaintext is binary.
Example
U2FsdGVkX18BAgMEBQYHCJnMd6AFlnrJQetke2YRwuM= (passphrase "secret", CBC, EVP_BytesToKey MD5)
Hello, World!
Produced by openssl enc -des-cbc -md md5 -k secret -S 0102030405060708 -a.
When to use DES Decryption
Use it to recover data from legacy systems or to check DES test vectors. Once decrypted, re-encrypt anything worth keeping with AES.
How DES Decryption works
For Salted__ input the salt is read from bytes 8–16 and the 8-byte key and IV are re-derived from the passphrase (EVP_BytesToKey MD5 or PBKDF2-SHA256). Raw input is decrypted with your 8-byte key and IV. In CBC and ECB the PKCS#7 padding is checked so that a wrong key gives a clear error.
Common Use Cases
- Read old DES-encrypted configuration or export files
- Verify DES known-answer tests
- Debug a legacy integration that still uses DES-CBC
- Migrate DES-encrypted values to AES
Security Note
DES uses a 56-bit key that can be brute-forced in hours on commodity hardware. Use this tool only to read or reproduce legacy data; never encrypt new data with DES.
FAQs
Decryption fails with "Invalid padding". Why?
The key, IV or mode does not match, or the data is not DES at all (it may be 3DES, which also has 8-byte blocks). Try the Triple DES decrypt tool if the key is 16 or 24 bytes.
Can the tool brute-force a lost DES key?
No. It only decrypts with a key or passphrase you provide.
Which OpenSSL command decrypts the same data?
openssl enc -d -des-cbc -md md5 -a -A -provider legacy -provider default -k <passphrase> – the page shows the command for your settings.