OpenSSL AES Decrypt & Compatibility Checker

This checker handles standard passphrase-based openssl enc envelopes that begin with Salted__ and contain AES-128-CBC, AES-192-CBC, or AES-256-CBC ciphertext. PBKDF2 supports SHA-1, SHA-256, SHA-384, and SHA-512. The CryptoJS / old OpenSSL preset is limited to AES-256-CBC with EVP_BytesToKey and MD5.

Raw -K/-iv ciphertext, -nosalt, explicit OpenSSL 3 -S output without an embedded header, -nopad, GCM, CMS, and non-AES ciphers are intentionally unsupported.

bad decrypt usually means the selected recipe did not produce valid CBC padding. Match the original passphrase, AES size, KDF, digest, iteration count, salt length, and Base64 handling before changing anything else. The error does not identify which one differs.

The marker identifies a compatible salted envelope shape. It does not prove that OpenSSL created the value and it does not store the cipher, KDF, digest, iteration count, passphrase, or salt length. OpenSSL 3.2 added -saltlen for PBKDF2, so decryption must use the same length that encryption used.

This tool has a versioned public record with three synthetic cases. Each expected result is recomputed from the production diagnostic core during the release check; the record also publishes fixture and source SHA-256 digests.

• OPENSSL-PBKDF2-SHA256-VALID-001valid

  A salted AES-256-CBC payload should decrypt with the recorded PBKDF2 recipe.
• OPENSSL-PASSPHRASE-MISMATCH-002mismatch

  The same envelope is tested with a passphrase that does not match the original recipe.

  Expected code: BAD_DECRYPT.
• OPENSSL-BASE64-MALFORMED-003malformed

  The payload contains characters outside standard Base64.

  Expected code: INVALID_BASE64.

Open the complete citation evidence record (JSON)

Implementation source-sha256:90ec572ae1ac1d21; verified 2026-08-05. Read the record's scope before citing a result; structural or cryptographic evidence is not automatically an identity or trust verdict.

• Decrypt Text with OpenSSL - Reconstruct the original command and work through a focused bad-decrypt checklist.
• Encrypt Text with OpenSSL - Save the full recipe when creating new command-line ciphertext.
• String Format Identifier - Check whether an unfamiliar value has an OpenSSL, Base64, JWT, PEM, or other recognizable shape.
• Base64 Decode - Inspect the decoded bytes without treating Base64 as encryption.
• PBKDF2 Key Derivation - Reproduce raw derived bytes for a separate key-debugging workflow.
• AES-GCM Decrypt - Test an authenticated payload that uses an explicit key, IV, AAD, and tag.