Decrypt files and text

This article explains how to decrypt encrypted text data.

Encrypt files and textPower Automate Desktop is designed to work not only with on-premises software but also with cloud services, and it provides several actions related to security and encryption. This article explains how to encrypt a text file.

Calculate hash valuesExplains how to hash text and file data and calculate the hash value.

Encryption technology and things to keep in mind

The encryption technology used here is AES.

It’s still used in many environments today. A familiar example is that it’s also used for the connection between a Wi-Fi router and your devices (WPA2 / WPA3).

It’s hard to break by brute force, and with a key length of 256 bits, cracking it by brute force is considered impossible in any realistic amount of time.

It’s classified as symmetric-key encryption, which requires the same password for both encryption and decryption.

This means that if you lose the password, you can no longer decrypt the data back to its original state.

If you encrypt data with AES in Power Automate Desktop, be sure to keep a record of the password so you can decrypt it later.

Also, while this article explains how to decrypt data, as mentioned above, breaking it by brute force is extremely difficult.

Even if you forget the password, you might be able to crack it if you know the encryption algorithm and the password is short, but that isn’t very realistic.

Please note that this article only covers decrypting data that was encrypted with Power Automate Desktop, using the same password.

How to set the password

As mentioned above, you need a password to encrypt and decrypt with AES.

You can specify the password flexibly, for example by entering it directly or by using a variable, but we recommend an input variable marked as sensitive.

With this approach, you can keep the password secure both when configuring the flow and when running it.

Note

If you enter the password directly in the encryption key or decryption key field, the value is encrypted and saved using a machine-specific method. Because of this, if you open the flow on another machine, the directly entered password is no longer valid and you need to enter it again.

Decrypt specific text data

To decrypt specific string data that’s already encrypted, use the “Decrypt text with AES” action.

Details of the “Decrypt text with AES” action

The action has the following parameters.

Parameter	Value
Encoding	The encoding (character encoding) of the decrypted text
Text to decrypt	The text to decrypt (a Base64 string)
Decryption key	The password to use for decryption

Specify the same encoding, padding, and key size that you used for encryption. With different settings, the text can’t be decrypted correctly. The decryption result is stored in the variable DecryptedText.

If you turned on “Use salt” and “Use initialization vector” in the advanced settings when encrypting, you also need to turn them on when decrypting and specify the salt and initialization vector values (Base64 strings) that were generated during encryption.

Implement the sample flow by copying and pasting

As a sample, I prepared a flow that encrypts text data once and then decrypts it with the same key.

Copy the following code and paste it into the Power Automate Desktop flow designer to add the actions.

The sample assumes that an input variable named “password” exists, set up as described above.

SET TargetString TO $'''%'Text to encrypt'%'''
Cryptography.EncryptText.EncryptTextWithAES Encoding: Cryptography.EncryptionEncoding.UTF8 TextToEncrypt: TargetString EncryptionKey: password PaddingMode: Cryptography.PaddingMode.PKCS7 KeySize: Cryptography.AESKeySize.Bits256 EncryptedText=> EncryptedText
Cryptography.DecryptText.DecryptTextWithAES Encoding: Cryptography.EncryptionEncoding.UTF8 TextToDecrypt: EncryptedText DecryptionKey: password Padding: Cryptography.PaddingMode.PKCS7 KeySize: Cryptography.AESKeySize.Bits256 DecryptedText=> DecryptedText

When you run it, the target data is encrypted, and you can confirm that the decrypted result matches the original data.

Implement in Power Automate Desktop

1. In “Search actions,” type “Decrypt text with AES.”

2. Set the parameters as follows. %EncryptedText% is the variable produced by the encryption action in the sample flow.

   Parameter	Value
   Encoding	UTF-8
   Text to decrypt	%EncryptedText%
   Decryption key	The password to use for decryption

3. When you run the flow, the specified string is decrypted with AES.

Possible exceptions

If the decryption settings aren’t correct or the text contains unsupported characters, an error may occur during decryption.

We recommend adding error handling with an “On block error” block.

Tip

If you want to decrypt encrypted text and save it to a file, use the “Decrypt to file with AES” action. Its parameters are almost the same as “Decrypt text with AES,” and you additionally specify the destination file and what to do if the file already exists.