.env Decryption Tool

The .env Decryption Tool is the companion to the encryption tool: it takes a file of ENC: tokens and your passphrase, and restores the original values — one click, entirely in the browser.

Each token embeds its own random nonce and an AES-GCM authentication tag. That tag is what makes decryption safe: a wrong passphrase or a ciphertext modified in transit fails verification and is reported, rather than producing silently corrupted values.

Lines that are not encrypted — comments, blanks, and plaintext keys — pass through untouched, so the output is a faithful, readable copy of the original configuration.

• ENC: token support: parses the standard wrapped format.
• PBKDF2 key derivation: same parameters as encryption.
• Tamper detection: GCM tag verified per value.
• Whole-file: decrypts every line at once.
• Pass-through: comments and plaintext kept intact.
• Privacy first: Web Crypto, nothing uploaded.
• Clear errors: wrong passphrase reported cleanly.
• Free: ready whenever you need it.

1. Paste the encrypted .env into the input, or load the sample.
2. Enter the passphrase used at encryption time.
3. Click Decrypt. Every ENC: value becomes plaintext.
4. Copy or download the decrypted file and save it securely.

Example 1 — Restoring a backup. An encrypted config backup is restored on a new machine once the vaulted passphrase is entered.

Example 2 — Onboarding handoff. A new teammate receives the encrypted .env and decrypts it locally with the team passphrase.

Example 3 — Verifying the passphrase. Someone forgets which passphrase was used; the authenticator immediately distinguishes the correct one from the wrong ones.

Example 4 — CI secrets restore. A pipeline decrypts an encrypted template at build time, feeding real values into the environment.

Example 5 — Corruption check. After a disk copy, a token that was truncated fails the GCM check, telling the team the copy is bad before anything runs.

• Faithful restore: values decoded, file structure kept.
• Authenticated: tampering or typos are caught.
• Local: nothing leaves the browser.
• Fast: whole-file round trip in one click.
• Required passphrase: never caches or asks to share.
• Free: unlimited decrypts.