Skip to main content
Tool Factory

Cryptography & Ciphers

Fernet Decryption

Apply Fernet Decrypt with explicit key, format, and algorithm settings. Enter the data and key material, choose the parameters, then review the result.

Tool workspace

Your input stays in this browser.

Add the required input to continue.

Needs input

You can run the tool again after any change.

Options

Your result appears here

Apply Fernet Decrypt with explicit key, format, and algorithm settings. Enter the data and key material, choose the parameters, then review the result.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

Fernet Decryption uses Fernet to process the supplied input. Encryption returns a Fernet token; decryption returns the authenticated plaintext or fails verification. This record describes decryption or decoding for Fernet Decryption.

Encryption returns a Fernet token; decryption returns the authenticated plaintext or fails verification. This record describes decryption or decoding for Fernet Decryption. Processing runs in the browser for this catalog category, so the result depends on the supplied bytes and settings. Processing runs in the browser.

Fernet combines encryption and authentication for a token; it does not replace access control or secure key storage.

Instructions

  1. Provide text or data for this tool.
  2. Use a generated test key and do not paste a production key. This applies to Fernet Decryption.
  3. Copy the complete token without changing its URL-safe Base64 characters. This applies to Fernet Decryption.
  4. Decrypt with the same key and inspect authentication errors before retrying. This applies to Fernet Decryption.

Example

Input: Plaintext "Test message"; key: a public 32-byte URL-safe Base64 test key. Operation direction: decryption or decoding; algorithm: Fernet Decryption.

Settings: Fernet Decryption: Key: URL-safe Base64 Fernet key. Input: Text; output: the Fernet token string. Use the paired encrypt or decrypt operation.

Result: Encryption returns a Fernet token; decryption returns the authenticated plaintext or fails verification. This record describes decryption or decoding for Fernet Decryption. Processing runs in the browser for this catalog category, so the result depends on the supplied bytes and settings.

Limits

  • Fernet Decryption: The operation cannot recover a missing or incorrect key.
  • Fernet Decryption: Token validity does not identify the person who created it.
  • Fernet Decryption: Use an application key-management system for production secrets.

Questions

What key format does Fernet require?

Supply the Fernet secret in its URL-safe Base64 representation. A Fernet key is not an arbitrary short password. Keep its exact characters when transferring it between implementations.

Is a Fernet token only AES ciphertext?

A Fernet token packages several fields with ciphertext and an authentication code. Pass the complete token to the decrypt operation. Extracting only the ciphertext discards information needed by the token format.

Does this Fernet decrypt operation enforce token expiry?

The decrypt implementation sets its time-to-live option to 0. Do not use a successful decode here as proof that a token meets your application’s age limit. Apply your application’s time policy separately.