AES Decryption Online

Error messages and what they mean

When the text can't be decrypted, you'll see one of these:

• Enter both the encrypted text and the passphrase: one of the fields is empty.
• Not valid Base64: the string contains a character Base64 can't have, such as a quote or a period copied along with it, or it's missing a character at the end.
• Too short to be toolo AES output: the decoded bytes can't even hold the header, salt, IV and tag. Part of the string is missing, or it was never encrypted. SGVsbG8= gives this, because it's only the word Hello in Base64.
• Wrong password or the text was changed: the passphrase isn't exactly the one used to encrypt, the string was edited or cut short, or it came from a different tool.

Why a wrong passphrase and a changed text give the same error

AES-GCM stores a 16-byte authentication tag with the ciphertext. Decryption computes the tag again from the key and the ciphertext and compares the two. A wrong passphrase gives a wrong key, an edited byte gives different ciphertext, and either way the tags don't match, so Web Crypto returns nothing at all. That's what you want: no text is shown unless it's exactly what was encrypted with that passphrase.

The format, and texts from older versions

Current output (version 2) is the Base64 of the bytes 54 4C 02, a 16-byte salt, a 12-byte IV, then the AES-256-GCM ciphertext with its 16-byte tag at the end. The key comes from PBKDF2-HMAC-SHA256 with 600,000 iterations. Every version 2 string starts with VEwC.

Older toolo texts (version 1) have no header and use AES-256-CBC, a 16-byte IV and 100,000 PBKDF2 iterations. The decryptor recognizes them and still opens them. Version 1 has no authentication tag, so some edits to an old text can go unnoticed.

Decrypting AES from other tools

AES ciphertext doesn't describe itself. To decrypt output from another tool or library you need every setting it used:

• The mode: CBC, GCM, CTR or ECB. Decrypting with the wrong one fails or gives garbage.
• The key, exactly 16, 24 or 32 bytes and often written as hex. If you were given a password instead, you also need the key derivation function and its settings (salt, iterations, hash).
• The IV or nonce: 16 bytes for CBC and CTR, usually 12 for GCM. Many tools put it in front of the ciphertext.
• For GCM, the 16-byte tag. For CBC and ECB, the padding, which is almost always PKCS#7.
• The encoding of the ciphertext, Base64 or hex. Decoding hex as Base64 gives the wrong bytes.

Common errors in OpenSSL and Node.js

A string starting with U2FsdGVkX1 came from openssl enc or from CryptoJS with a passphrase. In CBC mode, a wrong IV only garbles the first 16 bytes of the result while the rest decrypts fine, which is a useful clue. The usual error messages:

• bad decrypt (OpenSSL and Node.js): wrong key or password, wrong mode, or a different key derivation. For openssl enc, the -pbkdf2 and -iter values must match the ones used to encrypt.
• *** WARNING : deprecated key derivation used: the text was encrypted without -pbkdf2. Since OpenSSL 1.1.0 that old derivation uses SHA-256, so text from OpenSSL 1.0 needs -md md5 to decrypt.
• wrong final block length: the ciphertext isn't a multiple of 16 bytes. It was cut short, or decoded with the wrong encoding.
• Invalid key length or Invalid initialization vector (Node.js): the key or IV has the wrong number of bytes for the cipher.
• Unsupported state or unable to authenticate data (Node.js): the GCM tag didn't match, which is the same check that gives this page's wrong password error.

Decrypt toolo output in your own code

These functions read version 2 output. In Python, the same byte offsets work with hashlib.pbkdf2_hmac for the key and AESGCM from the cryptography package.

const crypto = require("node:crypto");

function decryptToolo(base64, password) {
  const data = Buffer.from(base64, "base64");
  if (data.subarray(0, 3).toString("hex") !== "544c02") {
    throw new Error("Not toolo version 2 output");
  }
  const salt = data.subarray(3, 19);
  const iv = data.subarray(19, 31);
  const tag = data.subarray(data.length - 16);
  const ciphertext = data.subarray(31, data.length - 16);
  const key = crypto.pbkdf2Sync(password, salt, 600000, 32, "sha256");
  const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
  decipher.setAuthTag(tag);
  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
}

async function decryptToolo(base64, password) {
  const data = Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
  const salt = data.slice(3, 19);
  const iv = data.slice(19, 31);
  const material = await crypto.subtle.importKey(
    "raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveKey"]
  );
  const key = await crypto.subtle.deriveKey(
    { name: "PBKDF2", salt, iterations: 600000, hash: "SHA-256" },
    material,
    { name: "AES-GCM", length: 256 },
    false,
    ["decrypt"]
  );
  // Web Crypto expects the 16-byte tag at the end of the ciphertext, as stored.
  const plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, data.slice(31));
  return new TextDecoder().decode(plain);
}

Decrypt OpenSSL or raw-key AES-CBC output

For text made with openssl enc -aes-256-cbc, or by a tool that gave you a hex key and IV. The first command decrypts the OpenSSL example on the Examples tab.

# -pbkdf2 and -iter must match the values used to encrypt
openssl enc -d -aes-256-cbc -pbkdf2 -iter 600000 -a -A \
  -pass pass:'correct horse battery staple' -in message.b64

# 64 hex characters of key (32 bytes), 32 hex characters of IV (16 bytes)
openssl enc -d -aes-256-cbc -a -A \
  -K 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f \
  -iv 0f0e0d0c0b0a09080706050403020100 -in message.b64

const crypto = require("node:crypto");

function decryptCbc(base64, keyHex, ivHex) {
  const decipher = crypto.createDecipheriv(
    "aes-256-cbc", Buffer.from(keyHex, "hex"), Buffer.from(ivHex, "hex")
  );
  return Buffer.concat([
    decipher.update(Buffer.from(base64, "base64")),
    decipher.final(), // a wrong key usually throws "bad decrypt"
  ]).toString("utf8");
}