VoriTools

DES Text Encryption & Decryption Tester

Paste text and a passphrase: Encryption turns it into an OpenSSL-style salted container, Decrypt reads an existing DES ciphertext back. DES is a 56-bit cipher and is meant for older data, not for protecting secrets.

Runs locally in your browser

How to encrypt and decrypt DES text

One text field and one passphrase field: press Encryption to turn text into an OpenSSL-style salted container, or paste an existing DES ciphertext and press Decrypt to read it back. The result appears below the buttons.

Everything runs in the page with CryptoJS, so the text and the passphrase are not uploaded. DES is a 56-bit cipher from the 1970s, so this page exists to read and reproduce legacy DES data rather than to protect new secrets.

  1. Paste the text you want to encrypt, or an existing DES ciphertext that starts with U2FsdGVkX1, into the field at the top.
  2. Type the passphrase into the key field. The same passphrase is needed later to read the ciphertext; it is not stored anywhere.
  3. Press Encryption. The output is Base64: the Salted__ marker, eight random salt bytes, then the ciphertext.
  4. To read a ciphertext, paste it into the same field, keep the passphrase and press Decrypt.

What the output really is

The salted container and its random salt

The output is the container that CryptoJS and openssl enc produce: the eight bytes Salted__ (U2FsdGVkX1 in Base64), eight random bytes of salt, then the ciphertext. DES is a block cipher with 8-byte blocks, CBC mode and PKCS#7 padding, so the last block adds 1 to 8 bytes: two-byte and three-byte inputs both end up as 24-byte containers.

Because the salt is random on every run, the same text with the same passphrase produces a different string each time; identical output would be a fault.

Reading the output with OpenSSL

Key and IV are derived from the passphrase and the salt with the MD5-based EVP_BytesToKey that openssl enc uses with -md md5. A container from this page decrypts with openssl enc -d -des-cbc -md md5 -a -k "passphrase", and ciphertext produced by that OpenSSL command can be pasted back into the page; both directions were tested.

DES uses a 56-bit key and OpenSSL already warns that this key derivation is deprecated; the page keeps the old derivation on purpose, because that is what existing DES data uses.

Failures, and what a result does not prove

A wrong passphrase, a text that is not a container and an altered ciphertext all fail the padding check: the page clears the output and shows a message instead of keeping the previous result. An empty field or an empty passphrase is refused the same way, before anything runs.

The container has no MAC and no authenticated tag, so a decrypted value is data, not proof of authenticity. Use this page to read or reproduce old data, and a modern authenticated cipher for anything new.

Recent tools: