AES Decryption Tool — OpenSSL & CryptoJS Compatible

How AES Decryption Works

// AES-256-GCM decrypt with a passphrase (PBKDF2-HMAC-SHA256, 600,000 iterations).
// Identical code runs in the browser and in Node.js 20+ via Web Crypto.
async function aesGcmDecrypt(base64, passphrase) {
  const enc = new TextEncoder();
  const packed = Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
  const salt = packed.slice(0, 16), iv = packed.slice(16, 28); // salt(16) | iv(12)
  const ct = packed.slice(28);                                 // ciphertext + tag
  const baseKey = await crypto.subtle.importKey(
    'raw', enc.encode(passphrase), 'PBKDF2', false, ['deriveKey']);
  const key = await crypto.subtle.deriveKey(
    { name: 'PBKDF2', salt, iterations: 600000, hash: 'SHA-256' },
    baseKey, { name: 'AES-GCM', length: 256 }, false, ['decrypt']);
  const plain = await crypto.subtle.decrypt(
    { name: 'AES-GCM', iv }, key, ct);        // throws if the tag fails
  return new TextDecoder().decode(plain);     // recovered plaintext
}

Key Features

AES Decryption Examples

salt(16) ‖ iv(12) ‖ ciphertext ‖ tag(16), Base64 — from the encrypt page

The quick brown fox jumps over the lazy dog.

U2FsdGVkX18AESIzRFVmd1PBwxIFQpF+VgIhTK0aDHQ=

Attack at dawn!

How to Decrypt AES Ciphertext

1. 1

   Paste the ciphertext

   Drop your Base64 or Hex ciphertext into the input. If it begins with U2FsdGVkX1, the tool flags it as OpenSSL/CryptoJS format and offers to switch you to the right mode.

2. 2

   Set the format and mode

   For a self-contained string from this tool, keep Passphrase mode and the matching GCM/CBC/CTR. For OpenSSL/CryptoJS output, accept the switch (CBC + passphrase). For raw-key data, choose Raw key and the encoding, and supply the IV if it is not prepended.

3. 3

   Choose the key-derivation function

   In OpenSSL mode, pick PBKDF2 (and its iteration count), EVP-SHA256, or EVP-MD5 to match how the key was derived. EVP-MD5 is the one CryptoJS uses.

4. 4

   Enter the passphrase or key

   Type the exact passphrase, or paste the exact raw key as hex or Base64. The plaintext appears on the right as soon as everything matches.

5. 5

   Read the diagnosis if it fails

   If decryption errors, the panel names the likely cause — wrong IV, wrong key, padding error, base64 pollution, or a KDF mismatch — so you can adjust one setting at a time instead of guessing.

Why AES Decryption Fails — and How to Fix It

mode: CBC        // but the data was encrypted with GCM
=> Authentication failed

mode: GCM, same passphrase and key size as encryption
=> plaintext

iv: 00000000000000000000000000000000   (wrong IV)
=> first block corrupt, rest readable

iv: (the exact IV used to encrypt)
=> Attack at dawn!

passphrase: hunter3   // one character off
=> padding error

passphrase: hunter2   // exact
=> plaintext

“U2FsdGVkX1...”   (curly quotes and trailing junk copied in)

U2FsdGVkX18AESIzRFVmd1PBwxIFQpF+VgIhTK0aDHQ=   (clean Base64)

OpenSSL compatible: off
input: U2FsdGVkX1...
=> cannot parse

OpenSSL compatible: on, KDF chosen
=> plaintext

KDF: PBKDF2       // CryptoJS ciphertext
=> padding error

KDF: EVP-MD5      // matches CryptoJS
=> plaintext

What You Can Do with AES Decryption

Decrypt openssl enc output

Read a Salted__ blob produced by openssl enc -aes-256-cbc without dropping to a terminal: paste the Base64, enter the passphrase, pick the KDF, and get your plaintext.

Decrypt CryptoJS ciphertext

Recover data from a legacy app that used CryptoJS AES.encrypt(text, passphrase). Select EVP-MD5 to match its single-pass MD5 key derivation — the step most people miss.

Debug a decryption that keeps failing

When your own code cannot decrypt something, paste it here to isolate whether the problem is the key, the IV, the mode, the encoding, or the KDF, using the diagnosis panel.

Verify an encryption round-trip

Confirm that ciphertext from the AES encrypt page or from your app decrypts back to the exact original bytes.

Understand an unknown ciphertext

Identify a format from its shape — a U2FsdGVkX1 prefix, or a fixed-length prefix that looks like an IV — and work out how it was produced before you try a key.

AES Decryption Internals & Formats

GCM decryption — authenticated

GCM recomputes the 128-bit tag over the ciphertext and compares it before returning any plaintext; a mismatch throws instead of leaking corrupted data. It uses the 96-bit IV that was prepended. A GCM failure means the key, mode, IV, or ciphertext is wrong — the cipher cannot tell you which, only that authentication failed.

CBC decryption — watch the first block and the padding

CBC has two distinct failure signatures. If only the first 16-byte block is garbled and the rest looks right, the IV was wrong. If every block is garbage, the key is wrong. A PKCS#7 padding error usually means the key is wrong, or the ciphertext was corrupted or truncated. CBC has no tag (unlike an authenticated construction such as an HMAC), so a wrong key can even decrypt to plausible-looking bytes.

CTR decryption — silent on error

CTR never throws: a wrong key simply yields garbage, which usually surfaces as a 'not valid UTF-8' error once the bytes are decoded to text. Match the counter/IV exactly. Because there is no integrity check, treat any CTR output you did not authenticate separately with suspicion.

Ciphertext layouts (F1 / F2 / F3)

Format 1 (passphrase) is salt(16) then IV then ciphertext, with the 16-byte GCM tag appended in GCM mode. Format 2 (raw key) is IV then ciphertext, or bare ciphertext with a separately supplied IV. Format 3 (OpenSSL) is the ASCII header Salted__ then an 8-byte salt then ciphertext. Knowing which layout you have tells the tool where the salt and IV live, and a raw key itself should come from a CSPRNG — see the secret key generator.

Key derivation: matching what encrypted the data

For self-contained passphrase ciphertext this tool uses PBKDF2-HMAC-SHA256 at 600,000 iterations. For OpenSSL/CryptoJS ciphertext you must select the KDF that was used: PBKDF2 (the openssl -pbkdf2 default is 10,000 iterations — set your exact count), EVP_BytesToKey with SHA-256 (openssl 1.1+ without -pbkdf2), or EVP_BytesToKey with MD5 and a single pass (CryptoJS and openssl 1.0.2 and earlier). The classic 'it will not decrypt' bug is a CryptoJS or old-openssl ciphertext tried with SHA-256 — switch to EVP-MD5 and it works.

AES Decryption Best Practices

Start by identifying the format

Before touching settings, look at the ciphertext. A U2FsdGVkX1 prefix means OpenSSL/CryptoJS; a self-contained string from this tool is passphrase format; a bare blob usually needs a raw key and a separate IV.

Match the key-derivation function exactly

For OpenSSL/CryptoJS ciphertext the KDF is as important as the passphrase. If PBKDF2 fails, try EVP-MD5 (CryptoJS, old openssl); the iteration count must match too, not just the algorithm.

Paste the ciphertext cleanly

Stray newlines or spaces from copying can corrupt Base64. This tool strips whitespace, but if decoding still fails, check for smart quotes, missing characters, or a truncated copy. Our Base64 tool can help you inspect a suspect string.

Treat a wrong-key result honestly

With CTR or CBC a wrong key can produce bytes rather than an error. If the output looks like garbage or fails the UTF-8 check, the key or IV is wrong — do not trust partial-looking output.

Never send secret ciphertext or keys to a server

The point of decrypting in the browser is that nothing leaves the page. Avoid tools that upload; this one uses Web Crypto locally, and you can verify with the Network tab or by going offline. AES-256 is strong — CNSA 2.0-approved for TOP SECRET — so if you cannot decrypt, the problem is the parameters, not the cipher.

AES Decryption FAQ