Find out which program encrypted a file — and how to open it — in one drop.
An encrypted file can only be opened by the program that encrypted it, with the right password or key. The hard part is usually knowing which program that was. Drop the file below: the identifier reads its signature and structure and tells you what it is and what to do next.
It runs entirely in your browser and reads only the beginning and end of the file. It never needs — and never asks for — a password.
Only the first 1 MB and the last 64 KB are read, inside your browser. Nothing is uploaded.
Salted__), CryptoJS text, GnuPG / OpenPGP, age, AES Crypt, AxCrypt, Ansible Vault, Mozilla SOPS.Most file formats begin with a fixed signature: a few bytes that name the format, such as %PDF for a PDF or PK for a ZIP. Encryption tools do the same — OpenSSL writes Salted__, CryptFile writes ENCF. The identifier checks the first bytes against a list of known signatures, then looks inside the structure where needed: a ZIP's encryption flag, the EncryptedPackage stream of a protected Office file, the /Encrypt entry of a PDF.
When there is no signature, it measures how random the bytes are. Encrypted data is indistinguishable from random noise; documents, images and program data are not. Combined with the file name, that separates "encrypted by an app", "probably ransomware" and "just an unknown format".
It identifies files; it does not break encryption. If a file was encrypted with a password or key you do not have, no tool can open it — and a website that claims otherwise is not telling the truth. The one exception is WeChat .dat images, which are only scrambled with a one-byte key and can be converted back to a normal image right here.
Find out which program encrypted a file, in your browser.
No. The identifier reads the first megabyte and the last 64 KB of the file inside your browser. Nothing is sent to a server, which you can confirm in your browser's developer tools.
It tells you what can. Files encrypted with CryptFile.Online can be decrypted here, and WeChat .dat images can be converted back to normal images here. Everything else needs the program that encrypted it and the right password or key.
Files with a signature, such as OpenSSL, GPG, protected Office documents, PDFs and archives, are identified with certainty. Files without one, such as VeraCrypt containers and app-encrypted media, are inferred from their randomness and name, and the result says so.
The identifier flags ransomware-renamed files and links to No More Ransom and ID Ransomware, which identify the strain and offer free decryptors where researchers have found one.