Advanced AES Decryption Tool

Decrypt AES Ciphertext

AES Mode

Choose the exact mode used during encryption.

Ciphertext Encoding

Select how your ciphertext is currently written.

Key Format

The decoded key must match the AES size exactly.

IV / Nonce Format

CBC, CTR, and GCM need the correct IV or nonce.

GCM Tag Format

Provide this only for GCM encrypted messages.

AAD for GCM

Leave blank unless the original encryption used AAD.

Ciphertext

Key

IV / Nonce

Authentication Tag

Example Data Table

Example	Mode	Ciphertext Encoding	Key Format	IV / Nonce Format	Tag Needed	Expected Output Type
Audit message sample	AES-256-CBC	Base64	Text, 32 bytes	Hex, 16 bytes	No	UTF-8 sentence
Structured log sample	AES-128-CTR	Hex	Hex, 16 bytes	Hex, 16 bytes	No	JSON fragment
Authenticated payload sample	AES-256-GCM	Base64	Base64, 32 bytes	Base64 nonce	Yes	Compact text output

These rows are reference examples for field combinations and output styles.

Formula Used

AES decryption is not a simple arithmetic calculator. This page applies a sequence of decoding, validation, authenticated checks when needed, and AES block or stream reversal.

C = Decode(ciphertext, selected_encoding)

K = Decode(key, selected_key_format)

IV = Decode(iv_or_nonce, selected_iv_format)

P = AES_Decrypt(C, K, Mode, IV)

For GCM: P = AuthDecrypt(C, K, Nonce, Tag, AAD)

Frequency(symbol i) = count(i) / total_symbols × 100

Entropy H = -Σ p(i) × log2(p(i))

The chart displays the most frequent characters or bytes in the decrypted output. That gives a quick mathematical view of structure, repetition, and output quality.

How to Use This Calculator

Select the exact AES mode that matches the original encryption process.
Choose the ciphertext encoding such as Base64, hex, or raw text bytes.
Paste the AES key and choose the correct key format.
Paste the IV or nonce in the matching format and length.
For GCM, also paste the authentication tag and optional AAD.
Submit the form to view the readable output, Base64 output, hex output, and metrics.
Use the CSV or PDF buttons to export the result summary.

FAQs

1. What does this AES decryption tool do?

It converts encoded ciphertext into bytes, validates the key and IV or nonce, and attempts AES decryption using the selected mode. When successful, it shows readable output, hex, Base64, metrics, and a frequency chart.

2. Why must the key length match exactly?

AES-128 requires 16 bytes, AES-192 requires 24 bytes, and AES-256 requires 32 bytes. Exact sizing avoids silent truncation, padding confusion, and incorrect results during decryption.

3. When do I need an IV or nonce?

CBC, CTR, and GCM all require the correct IV or nonce. Even with the right key, the wrong IV or nonce will produce invalid plaintext or failed authentication.

4. What is the GCM authentication tag?

The tag proves ciphertext integrity and authenticity. GCM decryption fails when the tag, nonce, AAD, key, or ciphertext differs from the original encryption inputs.

5. Why does the output sometimes look binary?

Some decrypted data is compressed, serialized, or non-UTF-8. In that case, this page still shows reliable hex and Base64 views so you can inspect the raw output safely.

6. What does the chart measure?

The Plotly graph shows the most frequent characters for readable text or the most common byte values for binary-like output. It helps compare structure and repetition visually.

7. What is entropy here?

Entropy summarizes how evenly byte values are distributed. Lower entropy suggests repeated patterns, while higher entropy usually indicates more mixed or less predictable output.

8. Can this tool recover unknown AES keys?

No. It only decrypts when you already have the correct key and related parameters. It is designed for validation, interoperability checks, and educational analysis of known AES inputs.