OpenSSL AES Decrypt & Compatibility Checker

This checker handles standard passphrase-based openssl enc envelopes that begin with Salted__ and contain AES-128-CBC, AES-192-CBC, or AES-256-CBC ciphertext. PBKDF2 supports SHA-1, SHA-256, SHA-384, and SHA-512. The CryptoJS / old OpenSSL preset is limited to AES-256-CBC with EVP_BytesToKey and MD5.

Raw -K/-iv ciphertext, -nosalt, explicit OpenSSL 3 -S output without an embedded header, -nopad, GCM, CMS, and non-AES ciphers are intentionally unsupported.

bad decrypt usually means the selected recipe did not produce valid CBC padding. Match the original passphrase, AES size, KDF, digest, iteration count, salt length, and Base64 handling before changing anything else. The error does not identify which one differs.

The marker identifies a compatible salted envelope shape. It does not prove that OpenSSL created the value and it does not store the cipher, KDF, digest, iteration count, passphrase, or salt length. OpenSSL 3.2 added -saltlen for PBKDF2, so decryption must use the same length that encryption used.

• Decrypt Text with OpenSSL - Reconstruct the original command and work through a focused bad-decrypt checklist.
• Encrypt Text with OpenSSL - Save the full recipe when creating new command-line ciphertext.
• String Format Identifier - Check whether an unfamiliar value has an OpenSSL, Base64, JWT, PEM, or other recognizable shape.
• Base64 Decode - Inspect the decoded bytes without treating Base64 as encryption.
• PBKDF2 Key Derivation - Reproduce raw derived bytes for a separate key-debugging workflow.
• AES-GCM Decrypt - Test an authenticated payload that uses an explicit key, IV, AAD, and tag.