Decrypt Text Online: Open AES-256 Encrypted Text With Your Password
To decrypt text online, load or paste the JSON saved by the Text Encryption Tool, type the password (or the 256-bit key) and click Decrypt Text. The original message appears under Decrypted Text, where you can press Copy or Download .txt. This free text decryption tool handles AES-256-GCM and AES-256-CBC, in Base64 or hex, with a password or a raw key. It runs in your browser, so nothing is uploaded; you can check the Network tab in your browser's DevTools.
If the password or key is wrong, or the IV, salt, mode or data do not match, the tool shows "Decryption failed" and no text; a missing field, a wrong CBC IV length or invalid Base64 or hex gets its own message. For GCM the success message adds that the authentication tag matched, so the data is unchanged. In password mode the tool uses the iteration count stored in the JSON. If that field is missing it tries 600,000 and then 100,000, the count used by files made before October 2026.
You can try it now. Paste the JSON below into Encrypted Text (or the whole JSON), enter sample-password as the password and decrypt: the result is "Meet at noon".
{
"encrypted": "pRcZxn+UWpXAClXL0LnyVQy0U/cA3t5jZoA46A==",
"iv": "zbqqKrsxwh7bnnvL",
"salt": "qLtP19lzE/jlLTErKLyilg==",
"mode": "GCM",
"format": "base64",
"keyType": "password",
"kdf": "PBKDF2-SHA256",
"iterations": 600000
}Text Decryption Table of Use: Inputs and Results
| Use case | What you provide | What happens |
|---|---|---|
| Open a file saved from the encryption tool | Click Choose JSON File, then type the password | All fields, mode and format are filled in; the text decrypts |
| Use a bundle copied with Copy All (JSON) | Paste it into Encrypted Text, then the password | The pasted JSON is recognised and split into its fields |
| Text encrypted with a raw key | Tick "It was encrypted with a 256-bit key, not a password" and enter 64 hex characters | No salt is needed; IV and key decrypt it |
| Data from your own code | Ciphertext with the GCM tag appended, 12-byte IV, salt, password | Decrypts if the key came from PBKDF2-HMAC-SHA256 with 600,000 or 100,000 iterations (or the "iterations" value in pasted JSON) and all values share one format |
| An older file from this site | JSON without an iterations field | Both 600,000 and 100,000 iterations are tried |
Decryption error messages and what they mean
| Message (shortened) | Likely cause | Fix |
|---|---|---|
| Decryption failed: the password or key is wrong | Wrong password or key, or a mismatched IV, salt, mode or format, or changed data | Re-load the original JSON and retype the password |
| AES-CBC needs a 16-byte IV | Mode is set to CBC but the data came from GCM (12-byte IV) | Click AES-256-GCM |
| AES-CBC data is always a multiple of 16 bytes | GCM data read as CBC, or part of the text is missing | Check the mode and paste the full text |
| The encrypted text, IV or salt is not valid Base64 (or hex) | Input Format does not match how the value was written | Click the other format button |
Text Decryption Tool Features
- Three ways in: choose a JSON file (.json or .txt, up to 50 MB, read locally), paste the whole JSON, or fill each field yourself.
- Automatic settings: a loaded JSON sets the mode, the format and password-or-key. Pasted ciphertext is read as hex if it has only 0-9 and a-f in an even count, otherwise as Base64 (standard or URL-safe, padding optional).
- Password or 256-bit key: passwords go through PBKDF2-HMAC-SHA256; a key must be exactly 64 hex characters.
- Checks before decrypting: it verifies the IV length for CBC (16 bytes), the ciphertext length and the encoding, and says which one is wrong.
- Strict text output: the result must be valid UTF-8; anything else counts as a failed decryption.
- Result tools: a character count, Copy, and Download .txt (saved as decrypted-text.txt). Pressing Enter in the password field also decrypts.
Limits: only 256-bit AES is supported (not 128 or 192), the output is always text rather than a file, and OpenSSL "Salted__" files are not parsed. If your data is only Base64 with no password involved, it is encoded rather than encrypted, and the Base64 decoder reads it.
How to Use the Text Decryption Tool
- Click Choose JSON File and select the file saved by the encryption tool, or paste the JSON into Encrypted Text (or the whole JSON). A blue note confirms what was loaded.
- If you are entering values by hand, fill IV (Initialization Vector) and Salt (for password-based), then set Encryption Mode and Input Format to match.
- Type the Password, or tick It was encrypted with a 256-bit key, not a password and enter the Custom Key.
- Click Decrypt Text. A green message confirms success; a red one explains what to check.
- Press Copy or Download .txt, then Reset to clear the fields.
Who Can Use the Text Decryption Tool
People who encrypted a note here and need it back, and recipients sent a JSON file with the password by another route. Developers use it to confirm that their own AES-GCM or AES-CBC output opens correctly, then compare the recovered text with the original in the text diff tool or check its length with the character counter.
Hex ciphertext can be inspected byte by byte with the hex to binary converter, and the JSON formatter helps when a bundle was pasted onto one line. Use the password generator for the next password, the Base64 encoder to re-encode a result, and a SHA-256 hash to prove that text did not change.
Text Decryption FAQs
How do I decrypt text made with the ZipConvert Text Encryption Tool?
Click "Choose JSON File" and pick the .json file you downloaded, or paste the JSON you copied with "Copy All (JSON)" into the Encrypted Text box. The encrypted text, IV, salt, mode and format fill in by themselves. Enter the password (or the 256-bit key), click Decrypt Text, and then copy the result or save it with "Download .txt".
Why does decryption fail even though my password is correct?
Every value must match what was used to encrypt: the IV, the salt, the mode (GCM or CBC) and the format (Base64 or Hex), and none may be cut short. One changed character makes a GCM authentication tag fail. Passwords are case-sensitive, so check Caps Lock and trailing spaces. Loading the original JSON file avoids copy-and-paste mistakes.
Can I decrypt data that was encrypted with OpenSSL, Python or Node.js?
Yes, if it is AES-256-GCM (16-byte tag appended to the ciphertext) or AES-256-CBC with PKCS#7 padding, and the ciphertext, IV and salt are all Base64 or all hex. A raw key goes in as 64 hex characters. A password key must come from PBKDF2-HMAC-SHA256; typed in by hand, only 600,000 and 100,000 iterations are tried, so for another count paste a JSON object with an "iterations" field. OpenSSL "Salted__" output is not supported.
Can I decrypt text without the IV or the salt?
No. The IV is always required, and the salt is required in password mode, because the key cannot be rebuilt without it. Neither is secret: the encryption tool stores both in its JSON next to the encrypted text. In 256-bit key mode there is no salt, so only the IV and the key are needed.
Is it safe to enter my password into an online decryption tool?
Here, yes: decryption runs in your browser through the Web Crypto API, and a JSON file you choose is read locally. Your encrypted text, password and key are not sent anywhere, which you can confirm in the Network tab of your browser's DevTools while you click Decrypt Text. On any site that cannot show this, assume the password is exposed.
How do I know the decrypted text is genuine and unchanged?
With AES-256-GCM, decryption only succeeds if the 16-byte authentication tag matches, so the success message means the right key was used and the data was not altered. AES-256-CBC has no such check. The tool rejects output that is not valid UTF-8 text, but it cannot prove that CBC data was left unchanged.
What is the difference between the Base64 and Hex input formats?
They are two ways of writing the same bytes. Base64 uses letters, digits, plus and slash and is shorter; hex uses only 0-9 and a-f, two characters per byte. The format must match how the data was written. It is detected when you paste or load JSON; click the other button if detection guesses wrong.
Can encrypted text be recovered if I forgot the password?
No. Strong encryption has no backdoor or master key, and nothing is stored on our side because decryption and encryption run only in your browser. If you remember part of the password you can retry as often as you like, since a failed attempt changes nothing. Otherwise the text is permanently unreadable.