How to use the AES Decryptor
1. Select the key size (AES-128, 192, or 256) and output format (Base64 or Hex) that was used during encryption — they must match.
2. Paste your secret hex key into the key field.
3. Paste the encrypted ciphertext into the input box — include the full string with the IV prefix.
4. The decrypted plaintext appears instantly.
Tip: if decryption fails with a "wrong key" error, check that you're using the same key size and output format that were used to encrypt.
What is it?
AES-CBC decryption reverses the encryption process. You need two things: the secret key (hex) and the ciphertext that includes the IV. The IV (Initialization Vector) is automatically embedded in the ciphertext output by our AES Encryptor — it's either the first 32 hex characters (hex format) or the Base64 segment before the colon (Base64 format).
AES is symmetric — the same key that encrypted the data can decrypt it. If decryption fails, the most common causes are: wrong key, wrong key size selected, wrong output format selected, or corrupted/incomplete ciphertext.
All decryption happens entirely in your browser using the CryptoJS library. No data is sent to any server. You can safely paste sensitive ciphertext here.
Example
abc123==:def456ciphertext==
{"user":"alice","role":"admin"}The ciphertext format must match the format used during encryption (Base64 or Hex), including the embedded IV.
Benefits
Verify data integrity instantly
Hash comparison confirms whether a file, API response, or downloaded binary has been altered in transit or at rest — without storing the original content.
Authenticate requests and webhooks
HMAC signatures prove a request came from a trusted source and was not modified in transit — the mechanism behind Stripe, GitHub, and AWS webhook security.
Protect sensitive data at rest
AES-256 encryption makes stored content unreadable to anyone without the key — even if your database, S3 bucket, or file system is fully compromised.
Generate credentials that meet security standards
Cryptographically random output from the Web Crypto API satisfies NIST entropy requirements — unlike predictable Math.random()-based alternatives.
Frequently asked questions
Why does decryption fail with 'wrong key'?
Most common causes: (1) wrong key — the key must be identical to what was used to encrypt, (2) wrong key size selected — AES-128/192/256 changes the expected key length, (3) wrong output format — Base64 vs Hex must match the encryption output format, (4) truncated or corrupted ciphertext.
What format should the ciphertext be in?
If you used Base64 format when encrypting: paste the full <IV>:<Ciphertext> string including the colon. If you used Hex format: paste the full hex string — the first 32 hex characters are the IV, the rest is the ciphertext.
Can I decrypt data encrypted by other AES tools?
Only if the other tool also uses AES-CBC with PKCS#7 padding and embeds the IV in the same format. Many AES implementations use different modes (GCM, ECB), padding schemes, or IV formats, which would produce 'wrong key' errors here.
Is it safe to paste my ciphertext here?
Yes — all decryption runs entirely in your browser. No ciphertext or keys are transmitted to any server. However, be careful not to paste sensitive keys in shared or monitored browser environments.
Where is the AES encryptor?
Use our AES Encryptor tool to encrypt plaintext with AES-256 CBC and generate the encrypted output format compatible with this decryptor.