What do I need to decrypt AES ciphertext?

The ciphertext, the exact key, the IV used during encryption, and the mode (GCM or CBC). For GCM you also need the authentication tag, which is usually appended to the ciphertext.

Why does decryption fail with the correct key?

Common causes: wrong mode (GCM vs CBC), wrong IV, mismatched encoding of the ciphertext (Base64 vs hex), or in GCM, a missing or truncated authentication tag.

Is decryption performed locally?

Yes. The Web Crypto API does everything in your browser. Keys and ciphertext are never sent over the network.

aes · gcm/cbc · web crypto · local

Decrypt AES ciphertext locally

Paste the base64 ciphertext, IV, and raw AES key — get the plaintext back. Supports AES-GCM and AES-CBC. Runs entirely in your browser.

AES Decrypt

Mode

AES-GCM

AEAD

Key

—

raw

—

nonce

Status

—

web crypto

input · ciphertext + key + iv

Key (base64)

IV (base64)

Ciphertext (base64)

output · plaintext

Decrypt to see the plaintext…

Quick Start

How to decrypt an AES ciphertext

Provide the matching key, IV, and mode that were used during encryption. Web Crypto verifies (in GCM mode) and decrypts back to UTF-8 plaintext.

01
Paste the key
Raw AES key, base64. 128 / 192 / 256 bits.
Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.
keyUTF-8TextEncoderlosslesslive
key · raw bytes256 bit · UTF-8
```
base64(rawKey)
```
loaded · UTF-8MIME · ready
02
Paste the IV
12 bytes for GCM, 16 bytes for CBC.
Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.
ivWeb Cryptosubtledeterministiclive
iv · options12 B · live
```
base64(iv)
```
options applied · livelive
03
Paste ciphertext
Output of AES encryption, base64.
Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.
ctmemoisedoptionsinstantreactive
ct · encodedb64 · ready
```
base64(ct)
```
encoded · livelossless
04
Decrypt
GCM also verifies authenticity — wrong key/IV throws.
Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.
decryptclipboardblobMIME-correctclient-side
ok · copiedready · done
```
Hello, world
```
done · ready to shipsuccess

Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Use Cases

When to decrypt AES locally

Reading own ciphertexts, cross-tool verification, debugging.

Read your backups

Recover content from local AES-encrypted backups. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

Cross-tool verify

Match outputs of openssl, libsodium, PyCryptodome. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

API debugging

Inspect AES-encrypted blobs returned by your service. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

Forensics

Decrypt known-key blobs during incident response. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Teaching

Show GCM's authenticated-decrypt failure behavior. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Migration

Validate ciphertext while moving providers. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready

FAQ

Frequently asked questions

Why is my decryption failing?

Most common cause: wrong mode. GCM and CBC ciphertexts are not interchangeable. Also check IV length (12 vs 16 bytes) and that the key is the raw AES key, not a password.

What does the GCM error mean?

GCM appends an authentication tag. If the ciphertext, IV, or key are tampered, decryption fails with an authentication error.

Does it support PBKDF2-derived keys?

Yes — feed the derived raw key (base64) that the encrypt tool outputs. The PBKDF2 step happens in the encrypt tool.

Maximum ciphertext size?

Limited by browser memory. Several hundred MB is usually fine.

Is anything sent to a server?

No. AES decryption runs via Web Crypto — entirely locally in your browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!