---
title: "crypt.decrypt"
description: "Decrypts Base64 AES-256-CBC ciphertext into raw plaintext."
---

```lua
crypt.decrypt(ciphertext: string, key: string, iv: string, mode: string? = "CBC"): string
```

---

## Aliases

None.

---

## Arguments

<ParamField body="ciphertext" type="string" required>
  The Base64-encoded ciphertext returned by crypt.encrypt.
</ParamField>

<ParamField body="key" type="string" required>
  The same Base64-encoded 32-byte key used for encryption.
</ParamField>

<ParamField body="iv" type="string" required>
  The Base64 IV returned by crypt.encrypt; at least 16 decoded bytes are required.
</ParamField>

<ParamField body="mode" type="string" default={"\"CBC\""}>
  The encryption mode; this implementation supports CBC only.
</ParamField>

---

## Returns

<ResponseField name="data" type="string">
  The decrypted plaintext bytes.
</ResponseField>

Invalid encodings, key/IV sizes, mode, or native decryption failures raise. Preserve the IV returned by encrypt.

---

## Example

```lua
local key = crypt.generatekey()
local encrypted, iv = crypt.encrypt("hello", key)
local ok, plaintext = pcall(crypt.decrypt, encrypted, key, iv)
print(ok, plaintext)
```