AES Decryption

AES decryption online

AES decryption reverses AES encryption using the same secret key and compatible parameters. AES is the symmetric block cipher defined by NIST FIPS 197. This tool supports AES-128, AES-192, and AES-256 for encoded text or local file input.

Successful decryption requires more than entering a password or input keying material. The key size, mode, padding, key derivation method, salt, info, IV or nonce, ciphertext encoding, and any authentication data must match the encryption process.

How to decrypt AES data

1. Select text or file input. For text, choose the ciphertext encoding such as Hex or Base64.
2. Select the same AES key size and mode used for encryption.
3. Enter the direct key and IV, or reproduce the KDF settings and secret input.
4. Match the padding, salt, hash, and KDF-specific settings such as iterations or info.
5. For GCM, supply the nonce and the same AAD when it was used during encryption. Keep Append Tag enabled when the final bytes of the input contain the authentication tag. Disable it when the tag is stored separately, then enter the detached Authentication Tag. KDF-derived GCM still requires this nonce because it is not derived from the KDF.
6. Decrypt and choose the appropriate text output encoding or download the file result.

If any parameter differs, decryption may fail or return meaningless bytes. An output that looks readable is not by itself proof that an unauthenticated ciphertext was genuine.

GCM authentication failures

GCM verifies an authentication tag in addition to decrypting the ciphertext. A wrong key, nonce, tag, or AAD should cause verification to fail. Do not ignore or bypass an authentication failure, because it means the data or required parameters do not match.

For modes such as CBC or CTR, integrity is not automatically guaranteed by encryption alone. Whether tampering can be detected depends on the complete format or protocol that produced the ciphertext.

AES compatibility checklist

When another tool returns a different result, compare:

• AES-128, AES-192, or AES-256
• Mode and padding
• Key bytes, passphrase encoding, or IKM encoding
• PBKDF2, EvpKDF, or HKDF parameters
• Salt and IV or nonce
• Ciphertext input encoding
• GCM tag length, tag placement, and AAD

Do not guess missing cryptographic parameters from the ciphertext. Obtain them from the producing application or format specification.

The standalone PBKDF2, EvpKDF, and HKDF tools can help compare derived bytes, but AES decryption still requires the final key, IV or nonce, mode, padding, and authentication parameters to match.

AES decryption FAQ

Can AES be decrypted without the key?

Not through ordinary use of the algorithm. This tool does not recover unknown keys or passwords; it performs decryption with parameters you supply.

Why do I get unreadable output?

The parameters may be wrong, or the plaintext may be binary rather than text. Verify every encryption setting and select the correct output encoding or file mode.

How do I create compatible ciphertext?

Use the AES Encryption tool and retain the selected mode, KDF, salt, info, IV, padding, authentication tag, and other parameters needed by the recipient.