We want to encrypt / encode URL parameters on our pages. I tried to encrypt a parameter using EncryptSymmetric() with AES algorithm as explained in the documentation

%%[SET @encData=EncryptSymmetric("test", "AES", @null, "1111", @null, "0000000000000000", @null, "00000000000000000000000000000000")
AES: %%=v(@encData)=%%

The result of this function is


Then I tried to decrypt the value using an online tool, but I always received an error message.

I suppose there is a difference between AES algorithm in Marketing Cloud and AES used in the online tool. Indeed if I encrypt the same word with an online tool (128-bit), I received this result


Do you have any deep information regarding this function? What could be the difference?

  • 2
    There are only certain types of SFMC encryption that you can decrypt outside of the platform. Commented Jan 26, 2017 at 17:05
  • Can you please elaborate on this? Struggling with AES in the Marketing cloud as well right now.
    – Alex
    Commented Mar 20, 2017 at 23:31
  • Struggling with this as well but need to decrypt the string in C#. Anyone was able to accomplish that?
    – Azimuth
    Commented Apr 30, 2020 at 16:20

4 Answers 4


I have decrypted SFMC encrypted strings in C# outside of the platform. Credit for the method goes to Pato Sapir on Github for his et-encrypt-decrypt solution.

You should be able to decrypt the string outside of the platform with the code referenced above if you use parameters like this in your AMPScript:


Also...props to @brandt for his answer, which is what lead me to psapir's solution:

DecryptSymmetric with tripe DES errors

  • Thanks @Adam for the answer. However i would use the same algorythm used in Salesforce (where i have AES128, 192 and 256). But there is no matching with that used in Marketing Cloud.
    – cmbob
    Commented Jan 27, 2017 at 15:38
  • 1
    @robertc SFMC is fussy about algorithms and particularly around padding, salt and Iv lengths, so you'll need get SF CRM to fit in around it, rather than the other way around.
    – Macca
    Commented Jan 31, 2017 at 9:03
  • 1
    Just saw this. Thanks @Adam and Eliot for noticing the post. more info here: devsutd.com/encryption-and-decryption-with-ampscript
    – patosapir
    Commented Feb 23, 2017 at 21:44

It is possible to get it working with AES too

The trick is block size 16, key size 32, pbkdf2 with 1000 iterations and padding pkcs7

import base64
from pprint import pprint
from Cryptodome.Cipher import AES

from Cryptodome.Protocol.KDF import PBKDF2
from Cryptodome.Util.Padding import pad

data = b'Example'
password = b'password'
salt = bytes.fromhex('0000000000000000')
iv = bytes.fromhex('00000000000000000000000000000000')

if __name__ == '__main__':
    block_size = 16
    key_size = 32
    key = PBKDF2(password, salt, key_size)  # pbkdf2 defaults to 1000 iterations

    cipher = AES.new(key, AES.MODE_CBC, iv)
    ct_bytes = cipher.encrypt(pad(data, block_size))  # pad defaults to pkcs7

    ct_b64 = base64.b64encode(ct_bytes).decode('utf-8')

    result = {
        'data': data.decode('utf-8'),
        'password': password.decode('utf-8'),
        'salt': salt.hex(),
        'iv': iv.hex(),
        'ciphertext': ct_b64,
    print('Expected ciphertext: L2pjkUH92JSH4KyVY0jGxw==')
  • Please note that this answer demonstrates how to use AES which provides improved security characteristics compared to DES and 3DES. security.stackexchange.com/questions/26179/…
    – jeyoor
    Commented Jul 23, 2023 at 18:33
  • I was able to reproduce the expected ciphertext from the code example with this AmpScript SET @cipherText=EncryptSymmetric("Example", "aes;mode=cbc;padding=pkcs7", @null, "password", @null, "0000000000000000", @null, "00000000000000000000000000000000")
    – jeyoor
    Commented Jul 26, 2023 at 23:21

I have implemented two (Java and Kotlin) versions of the same solution, after struggling myself to find one online:


It uses the BouncyCastle library since the core java libraries don't support PKCS7


this code in JS does return the same result as SFMC

    const password = 'PASSWORD';
    const salt = CryptoJS.enc.Hex.parse('0000000000000000');   
    const iv = CryptoJS.enc.Hex.parse('00000000000000000000000000000000');
    function encryptAES() {
    var value =  decodeURIComponent(document.getElementById("txtText").value);
    var key = buildKey(password, salt);
    var encryptedStringHex = CryptoJS.AES.encrypt(value, buildKey(password, salt), {iv: iv, mode: CryptoJS.mode.CBC, padding: CryptoJS.pad.Pkcs7}).toString();
    document.getElementById("txtEncryptedAES").value = encryptedStringHex.toString(); 
    function decryptAES() {
  var valueEncrypted = decodeURIComponent(document.getElementById("txtEncryptedAES").value);
   var key = buildKey(password, salt);
    var decryptedStringHex = CryptoJS.AES.decrypt(
     valueEncrypted, buildKey(password, salt), {iv: iv, mode: CryptoJS.mode.CBC, padding: CryptoJS.pad.Pkcs7});
    document.getElementById("txtDecryptedAES").value = decryptedStringHex.toString(CryptoJS.enc.Utf8);

    function buildKey(password, salt) {
    var key = CryptoJS.PBKDF2(password, salt, {
      keySize: 256 / 32,
      iterations: 1000,
      hasher: CryptoJS.algo.SHA1
    return key;

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .