I'm reading the documentation and I'm confused because functions in MC and SF have a different number of parameters (salt and password in MC, key in SFDC). Salesforce offers 3 versions of AES algorithms while in MC it's just AES. Has anyone had a successful experience of decrypting in Salesforce a value encrypted in Marketing Cloud? I have tried passing password as key and vector to different versions of AES decrypt in SF (128,192,256), but it's complaining about key or vector length.

This question has the answer on how to decrypt it outside of the platform in C# or python, but it's not applicable to Salesforce Apex. Solutions cannot be easily translated because they're not generic (i.e., technology-specific).


2 Answers 2


Finally I found a solution.

MKCloud AMPScript's default AES implementation is based on a 256 bit key size, CBC with 16 byte block size, and PKCS7 with 1000 iterations.

The derived Key generation is based on password and salt with PBKDF2, 1000 iteration, SHA-1 HMac function and 256 length.

Crypto Class cannot generate the Key like AMPScript because the method generateMac can not define the length so HmacSHA1 return 20 bytes instead 32. crypto.generateMac('HmacSHA1', Blob.valueOf(salt), Blob.valueOf(key));

SOLUTION: Use the following tool to generate the key, store it in SF and use it to decrypt https://8gwifi.org/pbkdf.jsp

Master Password - (MKCloud) @password
Salt (Base64) - (MKCloud) @salt (Convert from hex to base64 https://base64.guru/converter/encode/hex)
dkLen - 256
PBE Ciphers - PBKDF2WithHmacSHA1


Thank you for your answer @Jaume Bonet. Here's my code.

import crypto from 'crypto'; 
let password = 'anypasswordvalue';
let initVector = crypto.randomBytes(16); // 16 bytes (128 bits)
let salt = crypto.randomBytes(8); // 8 bytes (64 bits)

console.log('password: ' , password)
console.log('IV: ' , initVector.toString('hex'))
console.log('salt: ' , salt.toString('hex'))

let en = encryptAES('The quick brown fox jumps over the lazy dog! !@#$%^&*()_+', password, salt, initVector)
console.log('Encrypted Text: ' , en)

function encryptAES(data, password, salt, initVector) {
    // Generate key
    const key = crypto.pbkdf2Sync(password, Buffer.from(salt, 'hex'), 1000, 32, 'sha1');

    // Create cipher
    const cipher = crypto.createCipheriv('aes-256-cbc', key, Buffer.from(initVector, 'hex'));

    // Encrypt data
    let encrypted = cipher.update(data, 'utf8', 'base64');
    encrypted += cipher.final('base64');

    return encrypted;


        'Decoding: '
        , DecryptSymmetric('bfHMgljk/BpHudryDHranBLlEOZevJQvEH7Wj+nZxHNFYFHliBP+Bg9Esb61ZxiJ2AMRpGIknGaWPvvN1QIeUw==', "aes", @null, 'anypasswordvalue', @null, '701e6a98ec6e4f51', @null, 'c4a89623cbca32fa0a9d077569975fbc')

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .