Triple DES (3DES) Encryption
Encrypt text with Triple DES (DES-EDE3) using a passphrase in OpenSSL des-ede3-cbc format or a 16/24-byte hex key and IV. CBC, CFB, OFB and ECB modes.
Output uses the OpenSSL "Salted__" format in Base64: an 8-byte random salt followed by the ciphertext. Key and IV are derived from the passphrase and the salt, so the same text gives a different result every time. Equivalent command:
openssl enc -des-ede3-cbc -md md5 -a -A -k '…'Runs entirely in your browser. Your data is never uploaded.
What is Triple DES Encryption?
Encrypts data with Triple DES, which applies DES three times (encrypt–decrypt–encrypt) with two or three independent keys. It is still found in payment systems, older VPNs and enterprise software, so this tool helps you produce compatible data.
How to use Triple DES Encryption
- Keep Key source on Passphrase (OpenSSL-compatible) and type a Passphrase, or switch to Raw key + IV (hex) and enter the exact key and IV in hex.
- Choose the Mode and Padding (CBC with PKCS#7 is the OpenSSL default).
- Type or paste the Plaintext (or switch the input encoding to Hex for binary data).
- Click Encrypt, pick Base64 or Hex as the Output encoding and copy the ciphertext.
Example
Raw key 0123456789abcdeffedcba987654321089abcdef01234567, IV 1234567890abcdef, CBC, PKCS#7, plaintext "Triple DES test message"
w46mmLXKZ7SF3YdvRaW9PUPLk/6OeJll
Base64 output; identical to OpenSSL/Node des-ede3-cbc.
When to use Triple DES Encryption
Use it when a partner system or standard still mandates 3DES (some EMV/payment HSM workflows, legacy SOAP services) or to create test vectors. For new designs use AES-GCM.
How Triple DES Encryption works
3DES encrypts each 8-byte block as E(K3, D(K2, E(K1, block))). A 24-byte key gives three independent keys (keying option 1); a 16-byte key uses K3 = K1 (two-key 3DES). Passphrase mode derives a 24-byte key and 8-byte IV and writes the OpenSSL Salted__ format, compatible with openssl enc -des-ede3-cbc and CryptoJS.TripleDES.encrypt. Raw mode uses your hex key and IV; CBC/ECB are padded with PKCS#7.
Common Use Cases
- Produce data for a legacy system that only accepts 3DES-CBC
- Reproduce
CryptoJS.TripleDES.encrypt(text, passphrase)output - Create 2-key or 3-key 3DES test vectors
- Compare your implementation with OpenSSL's des-ede3-cbc
Security Note
Triple DES is deprecated: NIST disallowed it for encryption after 2023 and its 64-bit block makes long sessions vulnerable to Sweet32 birthday attacks. Use it only for compatibility.
FAQs
16-byte or 24-byte key?
24 bytes gives three independent DES keys (about 112 bits of effective security). A 16-byte key is two-key 3DES where the third key equals the first (about 80 bits).
Is the output compatible with OpenSSL?
Yes. In passphrase mode the result is exactly what openssl enc -des-ede3-cbc -md md5 -a -A -k <passphrase> produces (EVP_BytesToKey with MD5), or -pbkdf2 -iter N when you choose PBKDF2-HMAC-SHA256. Add -d to decrypt. The page shows the matching command under the passphrase field.
Is Triple DES still safe?
It is not broken outright, but it is slow, has a 64-bit block (Sweet32) and was withdrawn by NIST. Treat it as legacy only.