decrypt Code Examples and CFML Documentation

Argument Reference

string string
Required

Encrypted string to decrypt.

key string
Required

Key or seed used to encrypt the string.
* For the CFMX_COMPAT algorithm, any combination of any number of characters; used as a seed used to generate a 32-bit encryption key.
* For all other algorithms, a key in the format used by the algorithm. For these algorithms, use the GenerateSecretKey function to generate the key.

algorithm string
Default: `CFMX_COMPAT`

The algorithm to use to decrypt the string. Must be the same as the algorithm used to encrypt the string. See the encrypt function for additional algorithms.
ColdFusion Standard Edition installs the following algorithms:
* CFMX_COMPAT: the algorithm used in ColdFusion MX and prior releases. This algorithm is the least secure option (default).
* AES: the Advanced Encryption Standard specified by the National Institute of Standards and Technology (NIST) FIPS-197.
* BLOWFISH: the Blowfish algorithm defined by Bruce Schneier.
* DES: the Data Encryption Standard algorithm defined by NIST FIPS-46-3.
* DESEDE: the "Triple DES" algorithm defined by NIST FIPS-46-3.

NOTE: ColdFusion Enterprise Edition installs RSA BSafe Crypto-J library, which provides FIPS-140 Compliant Strong Cryptography. This also includes:
* DESX: The extended Data Encryption Standard symmetric encryption algorithm.
* RC2: The RC2 block symmetric encryption algorithm defined by RFC 2268.
* RC4: The RC4 symmetric encryption algorithm.
* RC5: The RC5 encryption algorithm.
* PBE: Password-based encryption algorithm defined in PKCS #5.
* AES/GCM/NoPadding: Encryption algorithm.

NOTE: If you install additional cryptography algorithms, you can also specify any of its encryption and decryption algorithms.

Values:

CFMX_COMPAT
AES
BLOWFISH
DES
DESEDE
DESX
RC2
RC4
RC5
PBE
AES/GCM/NoPadding

encoding string
Default: `UU`

The binary encoding used to represent the data as a string. Must be the same as the algorithm used to encrypt the string.
* Base64: the Base64 algorithm, as specified by IETF RFC 2045.
* Hex: the characters A-F and 0-9 represent the hexadecimal byte values.
* UU: the UNIX standard UUEncode algorithm (default).

NOTE: If you specify this parameter, you must also specify the algorithm parameter.

Values:

UU
Base64
Hex

iv binary

THIS PARAMETER IS MUTUALLY EXCLUSIVE WITH SALT.

Specify this parameter to adjust ColdFusion encryption to match the details of other encryption software.
* For Block Encryption Algorithms: This is the binary Initialization Vector value to use with the algorithm. The algorithm must contain a Feedback Mode other than ECB. This must be a binary value that is exactly the same size as the algorithm block size.
NOTE: If you specify this parameter, you must also specify the algorithm parameter.

salt binary

THIS PARAMETER IS MUTUALLY EXCLUSIVE WITH IV.

Specify this parameter to adjust ColdFusion encryption to match the details of other encryption software.
* For Password Based Encryption Algorithms: This is the binary Salt value to transform the password into a key.
NOTE: If you specify this parameter, you must also specify the algorithm parameter.

iterations numeric
Default: `0`

The number of iterations to transform the password into a binary key. Specify this parameter to adjust ColdFusion encryption to match the details of other encryption software.

NOTE: If you specify this parameter, you must also specify the algorithm parameter with a Password Based Encryption (PBE) algorithm.
NOTE: This parameter is used with the salt parameter. Do not specify this parameter for Block Encryption Algorithms.
NOTE: You must use the same value to encrypt and decrypt the data.

Compatibility

ColdFusion:

Version 4+ CF2018+ uses separate iv or salt named parameters.

Lucee:

Uses IVorSalt parameter or aliases of iv and salt.

Examples
Sample code invoking the decrypt function

Encrypt and Decrypt a Secret

Generate an AES 128 bit key and then use it to encrypt and decrypt a secret.

ex={};
ex.key = generateSecretKey("AES");
ex.secret = "top secret";
ex.encrypted=encrypt(ex.secret, ex.key, "AES", "Base64");
ex.decrypted=decrypt(ex.encrypted, ex.key, "AES", "Base64");
writeDump(ex);

decrypt

Argument Reference

string string Required

key string Required

algorithm string Default: CFMX_COMPAT

encoding string Default: UU