About the AES Decrypt
This tool decrypts AES-encrypted text in your browser. If you have Base64 text that starts with U2FsdGVkX1, it was made with a passphrase by CryptoJS, OpenSSL or our AES Encrypt tool: paste it with the passphrase to get the original message. For data from your own code or an API, switch to key-and-IV mode and choose AES-128, 192 or 256 in CBC, GCM, CTR, ECB, CFB or OFB, with the ciphertext in Base64 or hex. Clear messages explain what went wrong, such as a wrong key or bad padding.
Updated October 2026
How to use the AES Decrypt
- 1Choose Passphrase if the text starts with U2FsdGVkX1, otherwise Key and IV.
- 2Enter the passphrase, or the key, IV and mode that were used to encrypt.
- 3Choose whether the ciphertext is Base64 or hex.
- 4Paste the encrypted text.
- 5Read and copy the decrypted text.
Matching the settings used to encrypt
Decryption only works with exactly the same settings. For passphrase text you need the passphrase and the key size, nearly always AES-256. For raw text you need the key, the IV or nonce, the mode, the padding and the encoding of the ciphertext. If you don't know them, check the code or documentation of the system that encrypted the data.
Which mode should I pick?
GCM is the modern choice: it encrypts and also adds a 16-byte tag that detects any change to the data. CBC is the most widely supported mode and what most older systems and online tools expect. CTR turns AES into a stream cipher with no padding. ECB encrypts every block separately, so identical blocks give identical output; avoid it except to match an old system.
- GCM: encryption plus tamper detection, 12-byte nonce
- CBC: classic, needs a random 16-byte IV and padding
- CTR, CFB, OFB: stream modes, no padding
- ECB: no IV, leaks patterns, compatibility only
Common formats you may meet
Many apps put the IV in front of the ciphertext and encode both as Base64. If yours does, split off the first 16 bytes (32 hex digits) as the IV. For GCM, the tag is often appended to the end, which is what this tool expects; if your system stores it separately, append it before pasting.
Troubleshooting checklist
Most failures come down to one setting.
- Hex or Base64 chosen correctly?
- Key as text vs hex: 32 hex digits is 16 bytes, 32 characters of text is 32 bytes
- IV of the right length: 16 bytes, or 12 for GCM
- Padding off if the sender used none
- Same mode on both sides
On any device
Paste on a phone or computer; the decrypted text appears straight away and never leaves the page. If you only have a passphrase and a block of text, this is the right place to get the plain text back. To create a new encrypted message first, use AES Encrypt. Text Encryptor is a gentler choice for casual notes, and Base64 Encoder & Decoder helps when the ciphertext arrives wrapped in Base64.
Features
- Reads CryptoJS and OpenSSL Salted__ output
- AES-128, 192 and 256
- CBC, GCM, CTR, ECB, CFB and OFB
- Checks the GCM tag to catch tampering
- Shows hex when the result isn't text
- Private: decrypts on your device
Frequently asked questions
How do I decrypt U2FsdGVkX1 text?
Choose Passphrase, paste the text and type the passphrase. That prefix means it was encrypted with a passphrase in OpenSSL's Salted__ format, which CryptoJS.AES.encrypt uses.
Why does it say the padding is wrong?
With CBC and ECB, a wrong key, IV or mode produces garbage that fails the PKCS#7 padding check. Check each setting; the passphrase or key is the usual cause.
Why does GCM say the tag doesn't match?
GCM checks that the data hasn't changed. A wrong key or nonce, a missing last 16 bytes, or any edit to the ciphertext makes the check fail, and nothing is decrypted.
The result is shown as hex. What does that mean?
The decrypted bytes aren't readable text, which normally means a setting is wrong. With stream modes like CTR there is no padding check, so a wrong key gives random-looking bytes instead of an error.
Can I recover text if I forgot the passphrase?
No. AES has no back door. Without the right passphrase or key the text can't be decrypted.
Which key size was used?
In passphrase mode the default is AES-256, which CryptoJS uses for passphrases. In key mode the size follows from the key: 16, 24 or 32 bytes.