[HOW TO DECRYPT ENCRYPTED FILES]

Work out what encrypted the file, then use the tool that matches. There is no universal decrypter.

Decryption is not a single procedure. A file encrypted by 7-Zip, one encrypted by GnuPG and one held by ransomware need three completely different responses, and applying the wrong one wastes time. This guide gets you to the right one.

Before anything else, one thing is true in every case: you need the key or password. Modern encryption has no back door, so if the key is genuinely gone, no tool or service can recover the contents. Anything advertising otherwise is either lying or attacking a weak password by brute force.

[STEP 1 — IDENTIFY WHAT ENCRYPTED IT]

Three questions usually settle it: what is the file extension, where did the file come from, and did you encrypt it yourself?

Sign What encrypted it How to decrypt
.gpg .pgp .ascGnuPG / PGPgpg --decrypt file.gpg, or Kleopatra on Windows
.7z .zip .rarArchive with a password7-Zip or WinRAR — it prompts on extract
.aes .axxAES Crypt / AxCryptThe same application
.kdbxKeePass databaseKeePass or KeePassXC — it is opened, not decrypted to disk
.hc .vcVeraCrypt containerVeraCrypt — mount it as a drive
.encGeneric — many programsCheck the first bytes; see the .enc guide
Filename shown in green in Windows ExplorerWindows EFSLog in as the account that encrypted it — see below
Whole drive asks for a password at bootBitLocker or FileVaultRecovery key from your Microsoft or Apple account
Unknown extension appended to the original name, plus a ransom noteRansomwareStop and read the ransomware section below

If the extension tells you nothing, open the file in a hex viewer and read the first bytes. Most formats announce themselves: ENCF is CryptFile, Salted__ is OpenSSL, PK is a ZIP container, 7z¼¯' is 7-Zip.

[STEP 2 — DECRYPT WITH THE MATCHING TOOL]

Password-protected archives (7-Zip, WinRAR)

Open the archive normally and extract. The tool prompts for the password. If the archive was made with header encryption you cannot even see the file listing until you supply it.

GnuPG / PGP

Run gpg --decrypt secret.gpg > secret.pdf. For a public-key encrypted file you need the matching private key in your keyring — the sender's public key is not enough, and this is the single most common point of confusion with PGP.

OpenSSL

You must know which cipher was used, because the file does not record it: openssl enc -d -aes-256-cbc -pbkdf2 -in file.enc -out file. A wrong cipher produces a "bad decrypt" error rather than a helpful message. If the file was created by an older OpenSSL, omitting or adding -pbkdf2 changes the key derivation and will also fail.

Windows EFS (green filenames)

EFS ties the file to a Windows user account and its certificate. Logging in as that user decrypts it transparently — you do nothing. If you have reinstalled Windows, or you are looking at a drive pulled from another machine, you need the exported EFS certificate (a .pfx file) from the original installation. Without it the files are unrecoverable, which is why exporting that certificate is part of turning EFS on.

Office documents and PDFs

These carry encryption inside their own format. Open the file in Word, Excel or your PDF reader and enter the password when prompted. To remove it afterwards, use File → Info → Protect Document → Encrypt with Password and clear the field.

Files encrypted on this site

Use the file decryption tool. The algorithm and key method are read from the file header, so you only need the password or key.

[IF IT IS RANSOMWARE]

The pattern is distinctive: your files keep their original names with an unfamiliar extension added — invoice.pdf.locked, photo.jpg.crypt — and a text or HTML file appears in each folder demanding payment. Everything in this section is different from ordinary decryption.

  • No online decrypter can reverse it. Not this one, not any other. The attacker holds the key.
  • Identify the strain first. Upload a ransom note and one encrypted file to ID Ransomware. Knowing the family tells you whether a free decryptor exists.
  • Check No More Ransom. nomoreransom.org is run by Europol with the security industry and publishes genuine free decryptors for strains whose keys have been seized or whose implementation was flawed. It is the only trustworthy source of these.
  • Keep the encrypted files. Do not delete them. Decryptors are released months or years later; several major families have been broken long after the fact.
  • Avoid paid "recovery" services that will not name the strain. Many simply pay the ransom and add a margin.

[IF YOU HAVE LOST THE PASSWORD]

This is the outcome nobody wants, and being straight about it is more useful than false hope. If the encryption was implemented correctly and the password is genuinely gone, the file is gone. Before accepting that, though, these are worth checking — they recover files more often than people expect:

  • Your password manager, including entries you do not remember creating
  • Saved passwords in your browser
  • Old notes, emails to yourself, or a message where you sent the password to someone else
  • A backup of the file from before it was encrypted — check cloud storage version history, Windows File History, or macOS Time Machine
  • Whether a colleague or family member has the original

Brute-force recovery is only realistic when you remember most of the password and are missing a few characters. Tools such as Hashcat can search that space. Against a genuinely unknown password protected by PBKDF2 at 600,000 iterations, the search is not feasible.

[HOW TO DECRYPT AN ENCRYPTED FILE]

Identify what encrypted a file and decrypt it with the matching tool.

  1. Identify the encryption. Check the file extension and the first bytes of the file. The extension or magic number usually reveals which program encrypted it.
  2. Find the key or password. Locate the password or key file. Without it, correctly implemented encryption cannot be reversed by any tool.
  3. Use the matching tool. Decrypt with the program that created the file: 7-Zip for archives, GnuPG for .gpg, OpenSSL for Salted__ files, or the online tool for .enc files made on this site.
  4. Verify the result. Confirm the decrypted file opens correctly in its normal application. A tool that verifies an authentication tag will reject a corrupted file rather than produce damaged output.

[FREQUENTLY ASKED QUESTIONS]

How do I decrypt a file without the password?

You cannot, when the encryption is implemented correctly. AES-256 and comparable ciphers have no back door, and searching the key space is not achievable with any amount of computing power available today. The realistic options are finding the password somewhere you forgot you stored it, or restoring the file from a backup made before it was encrypted.

Is there a universal file decrypter?

No, and there cannot be. Every program stores encrypted data in its own container format, so a decrypter has to be written for each one — and it would still need your key. Tools advertising universal decryption are either limited to one format or are not doing what they claim.

How do I know which program encrypted my file?

Start with the extension: .gpg means GnuPG, .7z means 7-Zip, .kdbx means KeePass. If the extension is generic like .enc, open the file in a hex viewer and read the first bytes — ENCF is CryptFile.Online, Salted__ is OpenSSL, PK is a ZIP container. Where the file came from is the other strong clue.

Can encrypted files be decrypted for free?

Yes, in almost every legitimate case. The tools that perform decryption — 7-Zip, GnuPG, OpenSSL, VeraCrypt, and this site — are free. Paid file recovery is only relevant to damaged storage media, not to encryption, and paid services that promise to break encryption without a key cannot do so.

My files got encrypted by a virus. Can I decrypt them?

Only if a free decryptor exists for that specific ransomware family. Identify the strain at ID Ransomware, then check No More Ransom, the Europol-run project that publishes genuine decryptors. If none exists yet, keep the encrypted files — decryptors are sometimes released years later when keys are seized.

Why does decryption fail even though my password is correct?

Usually the password carries a trailing space from copy-paste, or the file was altered in transit — email gateways and messaging apps sometimes modify attachments. With OpenSSL specifically, you must also specify the same cipher and key-derivation options used to encrypt, since the file does not record them.