Triple DES (3DES) Decryption
Decrypt Triple DES (DES-EDE3) data from OpenSSL or CryptoJS with a passphrase, or raw ciphertext with a 16/24-byte hex key and IV. Runs locally in your browser.
Output uses the OpenSSL "Salted__" format in Base64: an 8-byte random salt followed by the ciphertext. Key and IV are derived from the passphrase and the salt, so the same text gives a different result every time. Equivalent command:
openssl enc -des-ede3-cbc -d -md md5 -a -A -k '…'Runs entirely in your browser. Your data is never uploaded.
What is Triple DES Decryption?
Decrypts 3DES ciphertext, either in the OpenSSL Salted__ Base64 format (from openssl enc -des-ede3-cbc or CryptoJS.TripleDES.encrypt) or as raw bytes with a hex key and IV. Wrong keys are detected through the PKCS#7 padding check.
How to use Triple DES Decryption
- Select the same Key source that was used to encrypt: Passphrase (OpenSSL-compatible) for
U2FsdGVkX1…("Salted__") data, or Raw key + IV (hex) for raw ciphertext. - Enter the passphrase (and the same Key derivation), or the hex key and IV.
- Set the same Mode and Padding as the sender and paste the Ciphertext (Base64 or Hex).
- Click Decrypt. Keep the output as Text (UTF-8), or switch to Hex if the plaintext is binary.
Example
U2FsdGVkX1+fAUPBci9K1t4/ytC3mL9Lj5o+GNDlCXc= (passphrase "secret", CBC)
Hello, World!
Produced by openssl enc -des-ede3-cbc -md md5 -a -k secret.
When to use Triple DES Decryption
Use it to read data from legacy systems, verify partner test vectors or debug an integration. Afterwards consider migrating the data to AES.
How Triple DES Decryption works
Salted__ input: the salt is read, a 24-byte key and 8-byte IV are re-derived from the passphrase (EVP_BytesToKey MD5 or PBKDF2-SHA256) and the data is decrypted with D(K1, E(K2, D(K3, block))) in the chosen mode. Raw input uses your key (16 or 24 bytes) and IV directly. The padding of the last block is validated before the text is shown.
Common Use Cases
- Decrypt a 3DES value from a legacy database export
- Check what a CryptoJS.TripleDES ciphertext contains
- Verify a payment system's 3DES test vector
- Find out whether data is 3DES or single DES
Security Note
Triple DES is deprecated: NIST disallowed it for encryption after 2023 and its 64-bit block makes long sessions vulnerable to Sweet32 birthday attacks. Use it only for compatibility.
FAQs
Decryption fails – what should I check?
The passphrase, the key derivation (MD5 vs PBKDF2), the mode and – for raw keys – whether the key is 16 or 24 bytes and the IV is correct. Some systems use ECB with no IV.
Can it read OpenSSL output made with default settings?
OpenSSL 1.1+ without -md md5 derives the key with SHA-256 (no PBKDF2), which is not supported. Use -md md5 or -pbkdf2 when encrypting.
Does it work with keys from an HSM?
If you know the raw key bytes, yes: choose Raw key + IV (hex) and enter them. Keys held inside an HSM cannot be exported to a browser.