# How to perform decryption outside of vault

**URL:** <https://discuss.hashicorp.com/t/how-to-perform-decryption-outside-of-vault/23198>\
**Category:** Vault\
**Created:** [April 15, 2021, 12:44pm UTC](https://discuss.hashicorp.com/t/how-to-perform-decryption-outside-of-vault/23198 "2021-04-15T12:44:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sothavirak](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/sothavirak/32/18647_2.png) [@sothavirak](https://discuss.hashicorp.com/u/sothavirak)\
**Post date:** [April 15, 2021, 12:44pm UTC](https://discuss.hashicorp.com/t/how-to-perform-decryption-outside-of-vault/23198/1 "2021-04-15T12:44:20Z")

</div>

Hi,

Let say we managed to export the key like below:

“keys”: {

```
        "1": "+DN274Zjp7BbObix4jJsPT9/3gC/ZHPjbQ8sU7JPHgs="

```

}  
“type”: “aes256-gcm96”

How can we construct the key outside of vault and decrypt below:

“ciphertext”: “vault:v1:bGJVtzjzo+weHnt+qsqaruANTHi89KvJNbn7HFTd8Q==”

As per documentation, after v1: is a base64 concatenation of the initialization vector (IV) and ciphertext.

---

<div class="post-metadata">

**Author:** ![sothavirak](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/sothavirak/32/18647_2.png) [@sothavirak](https://discuss.hashicorp.com/u/sothavirak)\
**Post date:** [April 16, 2021, 1:58am UTC](https://discuss.hashicorp.com/t/how-to-perform-decryption-outside-of-vault/23198/2 "2021-04-16T01:58:58Z")

</div>

> [@sothavirak](#):
>
> bGJVtzjzo+weHnt+qsqaruANTHi89KvJNbn7HFTd8Q==

I am answering my own question XD, found the answer below done in Java

byte cipherText = Base64.getDecoder().decode(“bGJVtzjzo+weHnt+qsqaruANTHi89KvJNbn7HFTd8Q==”);  
byte iv = Arrays.copyOfRange(cipherText, 0, 12);  
byte actual\_ciphertext = Arrays.copyOfRange(cipherText, 12, cipherText.length);  
byte key = Base64.getDecoder().decode(“+DN274Zjp7BbObix4jJsPT9/3gC/ZHPjbQ8sU7JPHgs=”);

decryptionKey = new SecretKeySpec(key, “AES”);  
cipher = Cipher.getInstance(“AES/GCM/NoPadding”);

cipher.init(Cipher.DECRYPT\_MODE, decryptionKey, new GCMParameterSpec(128, iv));  
System.out.println(Base64.getEncoder().encodeToString(cipher.doFinal(actual\_ciphertext)));