DES Encryption & Decryption
Decrypt or encrypt legacy data with single DES.
DES is weak by today's standards — use it to read old data; for new data use AES or ChaCha20. Go to AES
You'll need it again to decrypt. Nothing you type leaves this page.
OpenSSL's default is 10,000. Any number works: more makes the password slower to guess; decrypting needs the same number.
The usual choice with OpenSSL. Needs an IV; pads to whole blocks.
openssl enc -des-cbc -pbkdf2 -iter 10000 -a -A -provider legacy -provider defaultOpenSSL asks for the password; paste the text into it, or add -in and -out files.
DES, the Data Encryption Standard of 1977, encrypts 8-byte blocks with a 64-bit key of which only 56 bits count; the other 8 are parity bits. It was broken by brute force long ago, yet old files, configurations and databases still hold DES-encrypted values, and this page reads and writes them: CBC mode by default, or ECB, CFB, OFB or CTR, with a password in the openssl enc -pbkdf2 format or a 16-digit hex key and IV. Use it to recover old data, then re-encrypt that data with AES. It all runs in your browser: the data and its key never leave your device, and it's free with no sign-up.
How to decrypt DES-encrypted text
- Choose Decrypt and paste the Base64 or hex text — the format is detected automatically — or choose Encrypt and type text.
- Enter the password, or switch to Key & IV (hex) and enter the 16-digit key and 16-digit IV (ECB has no IV).
- Pick the mode the data was made with — usually CBC or ECB. Turn on No padding only if the data was encrypted without PKCS#7 padding.
- Copy or download the result; bytes that aren't text are shown as hex.
Features
- Single DES with a 64-bit key: 56 key bits plus 8 parity bits
- CBC, ECB, CFB, OFB and CTR modes; PKCS#7 padding or none
- Password mode in the openssl enc -pbkdf2 format, any PBKDF2 iteration count
- Key & IV mode with a 16-digit hex key and IV, typed or generated
- The openssl command to do the same, with OpenSSL 3's legacy provider
- Base64 or hex input detected automatically; non-text results shown as hex and downloadable as bytes
Is it private?
Yes. DES runs in WebAssembly inside your browser, so the old data you decrypt and its key or password are never uploaded or stored anywhere.
Frequently asked questions
Is DES encryption secure?
No. A 56-bit key can be found by trying every possibility: a purpose-built machine did it in 1998, and it is far cheaper today. Use DES only to read data that is already DES-encrypted, then re-encrypt it with AES or ChaCha20.
Why does OpenSSL say “Error setting cipher DES-CBC”?
Because OpenSSL 3 moved DES to its legacy provider, which isn't loaded by default. Add it: echo 'U2FsdGVkX1…' | openssl enc -d -des-cbc -pbkdf2 -iter 10000 -a -A -provider legacy -provider default. Use -des-ecb, -des-cfb or -des-ofb for those modes (OpenSSL has no DES CTR), and -K <16 hex digits> -iv <16 hex digits> instead of -pbkdf2 -iter in Key & IV mode.
What does a DES key look like?
8 bytes, written as 16 hex digits. The lowest bit of each byte is a parity bit that DES ignores, so keys that differ only in those bits decrypt the same way. The IV is also 8 bytes; ECB uses none. In password mode both are derived from the password, so you don't need either.
What is the difference between DES and Triple DES?
Triple DES runs DES three times with three keys — a 192-bit key, about 112 bits of real strength — which is why it outlived DES. Single DES has one 56-bit key and can be brute-forced. If your key is 16 or 24 bytes long, the data is Triple DES: use the Triple DES page.
Why do I get unreadable text?
Because a setting differs from the encryption: the password or key, the iteration count, the mode or the padding. With CFB, OFB and CTR, DES can't detect a mismatch and returns random bytes, which the page shows as hex; with CBC and ECB a mismatch usually ends in an error instead.