AES decryption tool (CBC, GCM, CTR, ECB)
Decrypt AES in every common mode and key size, with hex, Base64, or UTF-8 key material and automatic PKCS#7 padding removal. Runs on Web Crypto in your browser.
Open in ctfpalMost AES challenges fail not on the cryptography but on the plumbing: the key was hex and you pasted it as UTF-8, the IV was prepended to the ciphertext and you did not split it off, the padding was left on. Getting all four inputs in the right encoding is most of the work.
The mode tells you what to attack
| Mode | Needs | Weakness to look for |
|---|---|---|
| ECB | Key only | Identical plaintext blocks give identical ciphertext - detectable and exploitable |
| CBC | Key + IV | Padding oracle, bit flipping via the previous block |
| CTR | Key + nonce | Keystream reuse if the nonce repeats - crib drag it |
| GCM | Key + nonce | Forbidden attack on nonce reuse |
ECB detection is free
ECB encrypts each 16-byte block independently, so repeated plaintext blocks produce repeated ciphertext blocks. Split any ciphertext into 16-byte chunks and look for duplicates - if you find them, the mode is ECB and the structure of the plaintext is already leaking. The famous ECB penguin image is this exact property made visible.
Related tools
CBC padding oracle attack
Decrypt CBC ciphertext one byte at a time using only a valid/invalid padding signal - Vaudenay’s attack, explained and driven.
AES-GCM nonce reuse (forbidden attack)
Recover the GHASH authentication key from two messages encrypted under the same key and nonce, then forge arbitrary authenticated ciphertexts.
Hex to text converter
Convert hexadecimal to text and back, tolerating whitespace, commas, and `0x` prefixes. Runs entirely in your browser.
Flask session cookie decoder
Decode and verify Flask’s itsdangerous session cookies, with automatic zlib detection and both key-derivation schemes.