crypt.
Read ciphertext created by crypt.encrypt. Use the original key, returned IV, and matching AES mode; a new key or mismatched mode cannot recover a previous message.
Luau
crypt.decrypt(data: string, key: string, iv: string, mode: string?) -> stringParameters
| Parameter | Type | Description |
|---|---|---|
data | string | Base64 ciphertext whose decoded size is at most 16 MiB. |
key | string | Base64-encoded 32-byte key, such as the result of crypt.generatekey(). |
iv | string | Base64 IV saved from the encryption call. |
mode | string? | AES mode: CBC, ECB, CTR, CFB, OFB, or GCM. Names are case insensitive; CBC is the default. |
Returns
stringThe original plaintext bytes. Bad Base64, invalid parameters, and decryption failures raise errors.
Usage notes
Keep the key somewhere separate from the ciphertext. Save the returned IV with the ciphertext and pass the same mode to decrypt.
GCM also checks whether ciphertext was changed. The other listed modes do not provide that authentication on their own. CBC, CTR, CFB, and OFB use a 16-byte IV; GCM generates a 12-byte IV; ECB ignores the IV.
Wrap decryption in pcall when reading a file or message that may be damaged.
Example
Luau
local key = crypt.generatekey()
local ciphertext, iv = crypt.encrypt("private note", key, nil, "GCM")
local recovered = crypt.decrypt(ciphertext, key, iv, "GCM")
assert(recovered == "private note")