Which ransomware decryption tools exist, and are downloaded ones safe to use?

Trustworthy sources are few. These channels were still reachable as of September 2026:

Identify the family before hunting for a tool. ID Ransomware, run by MalwareHunterTeam, identifies ransomware from an uploaded note or sample and listed 1,186 detectable families when checked in September 2026. Our own online identification tool and extension lookup are another starting point. Identification sites return candidates; the exact version still needs sample analysis.

The table lists only families where we verified a public tool or a law enforcement key-matching channel. The emphasis is on limits, which matter more than whether a tool exists.

A family missing from this table is not automatically hopeless. But the families most active in China in recent years - Makop, Weaxor, TellYouThePass, BeijingCrypt and others - have no public free decryptor according to the checks recorded on our family pages. For those, time is better spent on backups, snapshots and structural repair than on hunting for decryptors; see can encrypted files be recovered.

• The fake tool is the malware. In 2020 the Zorab ransomware was distributed disguised as a STOP/Djvu decryptor; victims who ran it had their already-encrypted files encrypted a second time. Programs named as decryptors or removal tools can also carry infostealers or remote-access trojans.
• Lookalike download sites. Searching for a decryptor's "official download" does not guarantee the top result is the official site. Counterfeit download sites and disguised installers are one of the main trojan delivery channels of recent years; the Silver Fox trojan relies on them heavily.
• Paid decryption software and guaranteed decryption. Public decryptors are released free of charge. Be highly suspicious of anyone who wants payment before you can download a dedicated decryptor, or before they send a decryption code. A subtler version exists too: a 2019 ProPublica investigation found US data recovery firms that claimed proprietary decryption technology while actually paying the attackers and adding their own fee. The risks of paying are covered in should we pay the ransom.
• Impersonated "official support". If a tool or support agent claims a link to an agency or vendor, verify through that organisation's own website and ignore links sent in chat.

Check every condition in the tool's documentation against your own samples, not just the extension:

1. The family matches. The note's filename, text layout, contact details and victim ID format all agree with the family the tool describes. Look-alike names, impersonators and derivatives built from leaked source are common, and extensions alone are the easiest way to get this wrong.
2. The version and date match. Many tools cover only versions from a certain period - the Mallox tool stops at early 2024, for instance. Establish when encryption happened and what build the sample is.
3. The platform matches. Windows, Linux and ESXi encryptors are often separate implementations; the Rhysida tool supports only the Windows one.
4. The prerequisites are met. For tools that need a file pair, find a pre-encryption original of the same file - a mail attachment, an old backup, the same document in cloud storage. For tools that must run on the original computer, do not reinstall the OS first.
5. A small sample passes. Decrypt a few files of different types on copies and open each one to check the contents, rather than trusting the absence of an error message.

If any of these cannot be confirmed, stop and have the samples analysed. Our ransomware decryption service establishes family and version first, and runs a public tool on read-only copies only once the match is confirmed.

Most of the time a failed decryptor simply fails. These situations, however, cause irreversible loss:

• Decrypting in place. With the wrong version or key, a tool may write its incorrect output straight back into the file. Once the original ciphertext is overwritten, even the correct key found later cannot restore it.
• Treating a partly encrypted file as fully encrypted. A mismatched tool "decrypts" the intact regions too, turning plaintext into noise and destroying the room for structural repair along with it.
• Malware still running. When the Phobos / 8Base tool was released, No More Ransom warned that the malware must be removed first or files may be encrypted again and again.
• Installing tools and writing output on the original disk. This overwrites remnants of deleted original files. Keep the tool and its output on another disk.
• Rewritten file timestamps. Some recovery methods rely on modification times to narrow the key search - the published method for Akira's Linux/ESXi variant, for example - and careless copying, opening or renaming can rewrite those timestamps and close the route.
• Deleting encrypted originals right after "success". Output that looks fine does not mean every file is complete. Keep all encrypted originals until acceptance is finished.

Avast's decryptors offer an option in the wizard to back up encrypted files, and it should be ticked. Imaging everything and working on copies is still the safer approach.