- Home
- Encrypt
- Encrypt / Decrypt
- Triple DES (3DES)
Triple DES (3DES) Encryption & Decryption
Encrypt and decrypt text with Triple DES (DES-EDE3), for older systems.
Triple DES is weak by today's standards — use it to read old data; for new data use AES or ChaCha20. Go to AES
You'll need it again to decrypt. Nothing you type leaves this page.
OpenSSL's default is 10,000. Any number works: more makes the password slower to guess; decrypting needs the same number.
The usual choice with OpenSSL. Needs an IV; pads to whole blocks.
openssl enc -des-ede3-cbc -pbkdf2 -iter 10000 -a -AOpenSSL asks for the password; paste the text into it, or add -in and -out files.
Triple DES (3DES, TDES, TDEA) runs DES three times — encrypt, decrypt, encrypt — with a 192-bit key made of three DES keys. Payment systems, older databases and legacy integrations still use it, so this page is mainly for reading their data or producing data for them. It encrypts and decrypts text with 3-key Triple DES (OpenSSL's des-ede3) in CBC mode by default, or ECB, CFB, OFB or CTR, using a password in the openssl enc -pbkdf2 format or your own 48-digit hex key and IV. For new data use AES. Everything happens in your browser: the data and its key never leave your device, and it's free with no sign-up.
How to decrypt or encrypt Triple DES text
- Choose Decrypt and paste the Base64 or hex text — the format is detected automatically — or choose Encrypt and type the text.
- Enter the password, or switch to Key & IV (hex) and enter the 48-digit key and the 16-digit IV (ECB has no IV).
- Pick the mode the data was made with — usually CBC. Turn on No padding only if the data was encrypted without PKCS#7 padding.
- Copy or download the result. A result that isn't text is shown as hex and downloads as bytes.
Features
- 3-key Triple DES (DES-EDE3, 192-bit key); a 2-key key works when entered as K1 K2 K1
- CBC, ECB, CFB, OFB and CTR modes, with PKCS#7 padding or none
- Password mode readable by openssl enc -des-ede3-cbc -pbkdf2, without OpenSSL's legacy provider
- Key & IV mode: a 48-digit hex key and a 16-digit IV
- PBKDF2 iterations to match the data: 10,000, 100,000, 600,000 or any other number
- Base64 or hex in and out; results that aren't text are shown as hex and saved as bytes
- The matching openssl command, shown without your password or key
Is it private?
Yes. Triple DES runs in WebAssembly in your browser. The data you decrypt and its key or password are never uploaded or saved, so records from a payment or banking system stay on your computer.
Frequently asked questions
Is Triple DES still secure?
Not for new data. Its 8-byte block makes large amounts of data under one key vulnerable (the Sweet32 attack), and NIST disallowed Triple DES for encryption after 2023. The 3-key form still gives about 112 bits of security, so existing data isn't broken overnight — but encrypt anything new with AES or ChaCha20.
Can I decrypt it with OpenSSL?
Yes, and Triple DES needs no legacy provider: echo 'U2FsdGVkX1…' | openssl enc -d -des-ede3-cbc -pbkdf2 -iter 10000 -a -A (OpenSSL then asks for the password). Use -des-ede3 for ECB, -des-ede3-cfb or -des-ede3-ofb for those modes; OpenSSL has no Triple DES CTR. In Key & IV mode, use -K <48 hex digits> -iv <16 hex digits> instead of -pbkdf2 -iter.
My key is only 16 bytes. Is that 2-key Triple DES?
Yes. The page uses 3-key Triple DES, and a 2-key key K1 K2 is the same as the 3-key key K1 K2 K1: in Key & IV mode, enter your 32 hex digits followed by the first 16 of them again.
How do I move Triple DES data to AES?
Decrypt it here with its key or password, copy the text, and encrypt it again on the AES page — GCM mode if the reader supports it, CBC if it uses openssl enc. Both steps run in your browser, so the plain text is never sent anywhere in between.
Why does decryption fail or give unreadable text?
One setting differs from the encryption: the password or key, the iteration count, the mode or the padding. The ciphertext stores only the salt, so nothing else can be detected. In CBC and ECB a mismatch usually ends in an error; CFB, OFB and CTR can't tell, so you get random bytes, shown as hex. Data encrypted with a raw key rather than a password needs Key & IV mode.