Triple DES Encrypt / Decrypt
0/24 characters
Triple DES is deprecated. Prefer AES-256.
3DES was the industry's patch for DES's small key: run the cipher three times in encrypt-decrypt-encrypt order with a 24-character key that splits into three 8-byte DES keys. It bought two extra decades, mostly in payment systems, before NIST deprecated it — and its remaining legitimate job is reading data that older systems already encrypted.
Where the strength actually lands
Three 56-bit keys suggest 168 bits of security, but a meet-in-the-middle attack cuts effective strength to about 112 bits (roughly 5.19e33 operations) — still far beyond brute force, which is why 3DES survived as long as it did. The real killer is the block size it inherited from DES: 64 bits. With 8-byte blocks, birthday collisions become likely after about 2^32 blocks, which is only 32 GiB of data under one key — the basis of the 2016 Sweet32 attack against long-lived TLS and VPN sessions. AES's 16-byte block pushes the same math out by a factor of billions. Small key strength was fixable by tripling; small block size was not, and that is the real reason 3DES is retired rather than merely unfashionable.
This tool requires the full 24-character (3-key) form and counts characters live, turning the counter green at exactly 24; the field will not accept a 25th character. Some legacy systems use 2-key 3DES, a 16-byte key where the first and third DES keys are equal — to decrypt that here, paste the 16 characters and then repeat the first 8 at the end, which produces the identical 24-byte keying. Both modes work: CBC shows an optional IV field that takes up to 8 characters (3DES inherits DES's 8-byte block, so the IV is half the length AES uses), and a blank IV means all zeros — fine for testing, but the decrypting side must then also use a blank or all-zero IV. ECB values round-trip against OpenSSL's des-ede3-ecb exactly.
One thing people ask
My 3DES ciphertext from a Java service decrypts to garbage or fails here. What is different?
Usually one of three mismatches: the Java side used DESede in CBC mode with an IV you haven't matched here (set the identical 8-character IV in the field — blank means all zeros, which is rarely what a Java service used), the key there is binary or Base64 rather than 24 literal characters, or the padding differs (PKCS#5/7 here). Reproduce a known plaintext-ciphertext pair in ECB first to confirm the key matches, then bring the mode and IV back in.
For a quick sanity check of what the underlying single-DES layer produces, the DES tool uses the same library and padding. New designs should start at the AES tool with a 256-bit key.