How to Decrypt AES-256-GCM Locally

What you need before decrypting

To decrypt AES-256-GCM ciphertext you need three things: the password (or key), the salt used during key derivation, and the nonce (IV) used during encryption.

The salt and nonce do not need to be secret. Store them next to the ciphertext—for example, as separate fields in a file header or as companion files. Only the password has to stay secret.

If you encrypted the file with our AES-256-GCM encryptor, the salt and nonce are shown with the result so you can save them alongside the file. See our /en/blog/aes-256-gcm-decryption-guide for the encryption side.

If any of the three is missing or mismatched, decryption fails. That is by design: GCM authenticates the data and refuses to release plaintext that does not verify.

How the key is derived

Most browser-based tools, including ours, derive the AES-256 key from your password with PBKDF2 (HMAC-SHA256, 100,000 iterations) and the stored salt. Iteration counts are not comparable across tools: OWASP's current guidance for PBKDF2-HMAC-SHA256 is 600,000 iterations, while this site's AES tools ship with 100,000 — a deliberate trade of some resistance to offline guessing for a delay a browser can tolerate.

You must use the same KDF parameters that produced the key. If the tool that encrypted the file used a different iteration count or hash, the derived key will differ and the authentication tag will fail.

Step-by-step decryption

1. Open the decryption tool and select the file or paste the ciphertext (Base64 or hex).

2. Provide the salt and nonce if they are not embedded in the file header.

3. Enter the password used during encryption. The key is derived locally with PBKDF2.

4. Run decryption. GCM verifies the authentication tag first; only valid ciphertext is released as plaintext.

The whole process runs in your browser. No file, password, or key is sent to a server—you can verify this in the Network tab of the developer tools.

Decrypting with the Web Crypto API

The same steps work in your own application. Derive the key with PBKDF2, then call subtle.decrypt with the exact nonce:

async function decryptData(ciphertext, password, salt, iv) {
  const encoder = new TextEncoder();
  const keyMaterial = await crypto.subtle.importKey(
    'raw', encoder.encode(password), 'PBKDF2', false, ['deriveKey']
  );
  const key = await crypto.subtle.deriveKey(
    { name: 'PBKDF2', salt, iterations: 100000, hash: 'SHA-256' },
    keyMaterial, { name: 'AES-GCM', length: 256 }, false, ['decrypt']
  );
  const plaintext = await crypto.subtle.decrypt(
    { name: 'AES-GCM', iv, tagLength: 128 }, key, ciphertext
  );
  return new TextDecoder().decode(plaintext);
}

Common decryption errors and fixes

• Authentication tag verification failed – wrong password, wrong salt, or corrupted ciphertext. Check the inputs byte-for-byte.
• Wrong IV/nonce – GCM requires the exact nonce used at encryption time. A wrong nonce produces garbage or an authentication failure.
• Base64/hex mistakes – padding, line breaks, or URL-safe variants change the bytes. Normalize the encoding before decrypting.
• Encoding mismatch – the plaintext was UTF-8 text but you decoded the bytes as something else. Use TextDecoder('utf-8') for text output.

Security tips

• Never reuse a nonce with the same key—GCM becomes insecure after roughly 2^32 encryptions under one key.
• Keep passwords long and unique; the derived key is only as strong as the password.
• Back up the salt and nonce with the ciphertext; losing them makes decryption impossible even with the correct password.

Frequently Asked Questions

References

For new work, AES-256-GCM is the safer default because it authenticates the ciphertext in the same operation. If you want the full walkthrough of the second option, read our AES-GCM vs ChaCha20-Poly1305 comparison.

• NIST SP 800-38D – Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM): https://csrc.nist.gov/pubs/sp/800/38/d/final
• RFC 5116 – An Interface and Algorithms for Authenticated Encryption: https://www.rfc-editor.org/rfc/rfc5116
• W3C Web Cryptography API: https://www.w3.org/TR/WebCryptoAPI/