VoriTools

TripleDES Encrypt and Decrypt

Enter the text or compatible ciphertext and the matching passphrase. Choose encryption or decryption and copy the result.

Runs locally in your browser

How to encrypt and decrypt text with TripleDES

This page turns text into a Base64 TripleDES blob and turns such a blob back into text. Paste the content, type the passphrase, press Encrypt or Decrypt, then copy the result from the pane under the buttons. The work happens in the browser and nothing you paste is uploaded.

The blob is the container CryptoJS writes: Base64 whose decoded bytes start with the eight characters Salted__, then eight random salt bytes, then the ciphertext. The OpenSSL command line writes the same shape for Triple DES, so each side can be given the other's output.

  1. Paste the text you want to protect into the field at the top, or paste a Base64 blob when you want to read one back.
  2. Type the passphrase into the key field. Both directions need the same passphrase, and an empty one is turned away instead of becoming a blob that nobody can open.
  3. Press Encrypt for text to Base64 or Decrypt for Base64 to text. The result lands in the pane below the buttons; the status line above it stays quiet unless something went wrong.
  4. Press Copy to put the whole result on the clipboard, or select it by hand. Press Clear to empty the field, the passphrase and the result before the next document.
  5. Keep the passphrase together with the blob. Without it the blob stays closed: there is no recovery here, no reset and no key escrow.

The salted container, OpenSSL, and what a failed decrypt means

What the Base64 result is made of

Decoding the result gives three parts: the ASCII characters Salted__, eight salt bytes from the browser's random generator, and the ciphertext itself, written in 8-byte blocks with PKCS#7 padding. A 31-character input therefore carries 48 ciphertext bytes, and a single-character input carries eight.

The salt is new on every press, so the same text with the same passphrase produces a different Base64 string each time, and two runs cannot be compared by eye as proof that the inputs matched. The passphrase is not the key itself: it is stretched with MD5 into a 24-byte TripleDES key and an 8-byte IV, which is what the OpenSSL command line does with -md md5. The result is folded over several lines like the command line output, and it reads back with or without those line breaks.

OpenSSL reads this output and this page reads OpenSSL

Measured on OpenSSL 1.1.1k: openssl enc -d -des-ede3-cbc -md md5 -a -k decrypts a blob from this page, and a blob written by openssl enc -des-ede3-cbc -md md5 -a -k decrypts here. Given the salt from a page blob, the command line printed the same 24-byte key and 8-byte IV that this page derives and reproduced that blob byte for byte.

The flag is part of the format, not a detail: a blob written with -md sha256 or with -pbkdf2 is refused here, because a different key derivation produces a different key. Your data is not corrupt, it is simply locked with another derivation - decrypt it with the tool that wrote it, or re-encode it with -md md5 while you still have the passphrase.

When decryption fails, and where TripleDES still belongs

A wrong passphrase, one edited character in the Base64 and ordinary text pasted as if it were a blob all end the same way: the result is cleared and a single message names the three possible causes. The failure cannot be traced to one of them, because the padding check fails before the key can be judged. Empty input and an empty passphrase have their own messages.

TripleDES is a legacy cipher: three DES keys over 8-byte blocks, retired from new designs and kept alive by data that is already stored in it. Use this page to read such data or to produce a compatible value; for anything new, use AES. A successful round trip only proves that the passphrase matched - it says nothing about who wrote the blob or whether the plaintext can be trusted.

Recent tools: