About AES Decrypt
AES Decrypt reverses the encryption step: it takes a Base64 string produced by AES Encrypt, splits off the 12-byte initialisation vector stored at the front, rebuilds the key from your password and recovers the original plaintext. The operation runs entirely in your browser through the Web Crypto API, so neither the ciphertext nor the password is transmitted anywhere.
The mode is AES-GCM, which is authenticated. That means a wrong password or a single altered byte does not silently produce garbled output — the authentication tag fails to verify and the tool reports that decryption failed. You get either the correct plaintext or a clear error, never a plausible-looking corrupted result.
For the round trip to work, three things must match the encryption exactly: the same password, the same Base64 string, and a ciphertext that was produced with this 12-byte-IV, SHA-256-derived-key layout. If the string came from a different tool that used a different format, decryption will fail even with the right password, because the IV length and key derivation would not line up.
How to use AES Decrypt
- 1 Paste the Base64 ciphertext, exactly as produced by the AES Encrypt tool, into the ciphertext field.
- 2 Enter the same password that was used at encryption time — the two must be identical character for character.
- 3 Read the recovered plaintext, or a failure message if the password is wrong or the data has been changed.
Frequently asked questions
It says decryption failed. What does that mean?
Either the password does not match the one used to encrypt, or the Base64 string has been altered, truncated or pasted with missing characters. Because GCM verifies an authentication tag, any of those conditions produces an outright failure rather than partial or corrupted text.
Can it decrypt something encrypted by a different program?
Only if that program used the same scheme: a 12-byte IV prefix, AES-GCM, and a key derived as a single SHA-256 of the password. Many libraries default to a 16-byte IV or derive the key with PBKDF2 and a salt, in which case this tool cannot read the output.
Is the plaintext uploaded to a server?
No. The decryption is performed locally by JavaScript in the page, so the ciphertext and the password stay on your machine for the entire operation.
Why does the tool need the password at all — is it not stored?
Nothing is stored. AES has no recovery mechanism; the key is recomputed from the password you type each time. That is why a lost password means the data is unrecoverable, and also why no copy of your password exists anywhere.
Free, online, and private
Free to use
AES Decrypt is completely free. There is no account to create, no login, and no hidden charge or usage limit.
Runs online in your browser
It is a free online tool that runs entirely in your browser. Nothing to download or install — open the page and start using it right away.
Your data stays private
All processing happens locally on your device. Your input is never uploaded, stored, or tracked, so it never leaves your browser.
How AES Decrypt behaves in detail
These are the specifics of this implementation — the exact ranges, defaults and fixed settings you are working with.
| Parameter | Value |
|---|---|
| Cipher and mode | AES-GCM with the 128-bit authentication tag WebCrypto appends by default |
| Key derivation | one SHA-256 digest of the password bytes — no salt, no iteration count, no stretching |
| Input layout | base64 of a 12-byte IV followed by the ciphertext and its 16-byte tag |
| Default password | my-secret; the ciphertext field starts empty |
| Result on any failure | one fixed sentence: Decryption failed — wrong password or invalid ciphertext |
Compiled from the implementation of this tool and checked against it by itoolnet.
What AES Decrypt does not do
Knowing the edges of a tool saves more time than another list of its features. These are the cases where it will not do what you might expect.
- The expected input is exactly what this site's AES Encrypt produces: base64 of a 12-byte IV, then the GCM ciphertext and its tag. A ciphertext from another tool, or one with the IV stored separately, fails even when the password is correct, and the single error line cannot say which of the two was wrong.
- The key is one unsalted SHA-256 pass over the password. There is no salt field and no work factor, so the same password always derives the same key and anyone holding the ciphertext can test candidate passwords at raw SHA-256 speed with nothing slowing them down.
- Nothing is checked before the attempt. Bad base64, a cleared box, a string truncated to half its length and a genuinely wrong password all yield the identical one-line message, so the output never hints whether the input, the format or the password was at fault.
Tested and documented by itoolnet, the team that builds and maintains this site.