List of free Ransomware Decryption Tools to unlock files

If you are looking for a way to decrypt files encrypted by Ransomware then this complete list of Ransomware decrypt & removal tools will help you unlock files encrypted or locked by ransomware on your Windows computer. Ransomware threats are on the rise, and every other day we get to read about it – whether it is WannaCrypt, Petya or Locky ransomware. This class of malware seems to be the favorite now as it is very profitable – lock down users files and data and the demand money to unlock them.

Ransomware Decryption Tools

While there are some basic steps one can take to prevent ransomware, including making use of some free anti-ransomware software, it can still happen that you end up being a victim of some ransomware.

Well, what does one do after a Ransomware attack on your Windows computer?

Ransomware Decryption Tools

First of all, identify the Ransomware which has infected your computer. For this, you may use a free online service called ID Ransomware

If you are able to identify the ransomware, check if a ransomware decrypt tool is available for your type of ransomware. Currently, the following decryptor tools are available.

You may go through the entire list or press Ctrl+F and search for a specific ransomware name.

Before you use these tools, use any good antivirus software or ransomware removal tool to remove the ransomware. Only then should you use these ransomware file decryptor tools. However, if you have moved your encrypted files to another isolated secure system, you directly use these tools.

1] Decrypter for HydraCrypt and UmbreCrypt Ransomware: HydraCrypt and UmbreCrypt are the two new Ransomware variants from the CrypBoss Ransomware family. Once successful in breaching your PC security, HydraCrypt and UmbreCrypt can lock your computer and deny access to your own files.

2] CryptoLocker Decryption Tool : This free Decryptlocker or CryptoLocker Decryption online tool from FireEye and Fox-IT to decrypt the Cryptolocker encrypted files. UPDATE: The site appears to have been taken down.

3] Petya ransomware decrypt tool & password generator: PETYA ransomware is one of the most recent online threats for PC users. It is a malware which overwrites the MBR (Master Boot Record) of your PC and leaves it unbootable and also disallows restarting the PC in Safe Mode.

4] Operation Global III Ransomware Decryption Tool: This ransomware attacks your system and then displays a  leaving the user with no choice but to pay the ransom amount. All your encrypted file extensions are changed to .EXE and are infected with malicious codes.

5] Unlock files locked by Decrypt Protect ransomware using this tool from Emsisoft.

6] Emsisoft has released several decryptor tools for ransomware. This list currently includes ransomware decryption tools for:

AutoLocky, Nemucod, DMALocker2, HydraCrypt, UmbreCrypt, DMALocker, CrypBoss, Gomasom, LeChiffre, KeyBTC, Radamant, CryptInfinite, PClock, CryptoDefense, Harasom, Xorist, 777, BadBlock, DApocalypse, ApocalypseVM, Stampado, Fabiansomware, Philadelphia, FenixLocker, Al-Namrood, Globe, OzozaLocker, Globe2, NMoreira or XRatTeam or XPan, OpenToYou or OpenToDecrypt, GlobeImposter, MRCR, Globe3, Marlboro, OpenToYou, CryptON, Damage, Cry9, Cry128, Amnesia, Amnesia2, NemucodAES, BigBobRoss, PewCrypt, CryptoPokemon, ZQ Ransomware, MegaLocker, JSWorm 2.0, GetCrypt, Ims00rry, ZeroFks, JSWorm 4.0.

You can get them all for free at their official website along with detailed usage guides.

7] Cisco also offers a free Decryption Tool for TeslaCrypt Ransomware Victims. This TeslaCrypt Decryption Tool is an open source command line utility for decrypting TeslaCrypt ransomware encrypted files so users’ files can be returned to their original state. Read more on it here.

8] Cisco Talos has released PyLocky ransomware decryptor tool. This decryptor is intended to decrypt the files for those victims affected by the ransomware PyLocky.

9] TeslaCrack is available on GitHub. It will help you decrypt files that were encrypted with the latest version of the TeslaCrypt ransomware.

10] Trend Micro AntiRansomware Tool will help you take back ownership of your computer by removing the ransomware on infected computers. To use this tool, enter Safe Mode with Networking. Download the Anti-Ransomware software and save it to your desktop. Next double-click on it to install it. Once it has been installed, restart your computer and go to the normal mode where the screen is locked by the ransomware. Now trigger the Anti-Ransomware software by pressing the following keys: Left CTRL+ALT+T+I. Run the Scan, Clean and then Reboot your computer. This tool is useful in cases of ICE Ransomware infections.

11] Trend Micro Ransomware Screen Unlocker Tool will give you access to a ransomware blocked computer.

12] Trend Micro Ransomware File Decryptor tool will attempt to decrypt files encrypted by certain Ransomware families like CryptXXX, Crysis, DemoTool, DXXD, TeslaCrypt, SNSLocker, AutoLocky, BadBlock, 777, XORIST, Teamxrat/Xpan, XORBAT, CERBER, Stampado, Nemucod, Chimera, LECHIFFRE, MirCop, Jigsaw, Globe/Purge, V2:, V3:, etc.

13] HitmanPro.Kickstart is a free Ransomware Removal Tool that will help you rescue a ransomed PC. It lets you start your computer from a USB flash drive to remove malware that has ransomed or locked your computer and does not allow you to access it.

14] Shade Ransomware Decryption Tool will help decrypt files with the following extensions: .xtbl, .ytbl, .breaking_bad, .heisenberg. Go get it from McAfee Intel.

15] McAfee Ransomware Recover is a tool and a platform which not only unlock user files, applications, databases, and other encrypted files but is also available for the security community.

16] AVG has also released ransomware decrypt tools for the following ransomware:

Apocalypse, Bart ransomware, BadBlock, Crypt888, Legion, SZFLocker, TeslaCrypt.

Go get them all here.

17] Check Point has released a Cerber Ransomware Decryption Tool. It is an online tool where you have to upload a file. UPDATE: This Cerber Ransomware Decryption Tool has been rendered ineffective. Merry X-Mas Decryptor from CheckPoint can decrypt files encrypted by the Merry X-Mas ransomware. BarRax decryptor tool is designed to decrypt files encrypted by BarRax. Available at CheckPoint.

18] The decryption keys for the NoobCrypt ransomware have been posted on Twitter. Use these unlock keys ZdZ8EcvP95ki6NWR2j or lsakhBVLIKAHg if your computer gets infected.

19] Bitdefender has released the following ransomware decryption tools: Bart Ransomware Decryptor | Linux.Encoder.3  | Linux.Encoder.1  | BTCWare | GandCrab Decryptor | Annabelle Decryptor.

20] The CoinVault decryption tool decrypts files encrypted by Coinvault and Bitcryptor. ChimeraDecryptor tool is designed to decrypt files encrypted by Chimera. Get them all from NoMoreransome.org.

21] Vindows Ransomware Decryption Tool will help decrypt files locked by Vindows Locker. Download it here.

22] Download Decryptor from BleepingComputer to decrypt 8lock8 ransomware encrypted files.

23] Decryptor for Crypren ransomware encrypted files is available here.

24] Decryptor for Crypt38 ransomware encrypted files is available here.

25] Decryptor for CryptInfinite or DecryptorMax is available here.

26] For CryptoHost, you can use this password generator created by Michael Gillespie. The file is hosted on Dropbox.

27] Decryptor for my-Little-Ransomware is available on Github.

28] CERT-PL has released one for CryptoMix Decryptor

29] Popcorn Decryptor Tool is available here.

30] Avast has released decryption tools for the following ransomware:

AES_NI, Alcatraz, Locker, Apocalypse, BadBlock, Bart, BTCWare, Crypt888, CryptoMix (Offline) or CryptFile2, Zeta, CryptoShield ransomware family, CrySiS, EncrypTile, FindZip, Globe, HiddenTear, Jigsaw, LambdaLocker, Legion, NoobCrypt, Stampado, SZFLocker, TeslaCrypt, XData, BigBobRoss.

Get them all here.

31] ESET Crysis Decryptor is a free decryption tool for Crysis ransomware victims. Download it from Eset. It will also remove Dharma ransomware.

32] Kaspersky WindowsUnlocker can be useful if the Ransomware totally blocks access to your computer or even restrict access to select important functions, as it can clean up a ransomware infected Registry.

33] RannohDecryptor from Kaspersky will help decrypt files encrypted by the Rannoh, AutoIt, Fury, Crybola, Cryakl, CryptXXX, CryptXXX v.2, CryptXXX v.3, MarsJoke, Polyglot, Dharma ransomware. Download it from here.

34] Kaspersky have also released several other decryptor tools like Rector Decryptor, Rakhni Decryptor, Wildfire Decryptor, Scraper Decryptor, Shade Decryptor, Scatter Decryptor, Xoris Decryptor, etc – go get them here. They will decrypt files encrypted by Rakhni, Agent.iih, Aura, Autoit, Pletor, Rotor, Lamer, Lortok, Cryptokluchen, Democry, Bitman, TeslaCrypt and other ransomware.

35] Kaspersky Ransomware Decryptor will automatically decrypt all files for CoinVault and Bitcryptor victims. Get it here. It also helps in the case of Cryakl ransomware.

kaspersky decrypt tool

36] Visit the Kaspersky NoRansom web page to find out if they have released a decryption tool for your ransomware. Currently, the page shows the availability of WildfireDecryptor tool, ShadeDecryptor tool, RakhniDecryptor, RannohDecryptor tool and CoinVaultDecryptor tool. Also included are manual how-to’s and other useful resources about ransomware. Intel McAfee has also made a Wildfire Decryptor.

RakhniDecryptor will help decrypt files encrypted by Dharma, Crysis, Chimera, Rakhni, Agent.iih, Aura, Autoit, Pletor, Rotor, Lamer, Lortok, Cryptokluchen, Democry, Bitman (TeslaCrypt) version 3 and 4 ransomware.

37] Malwarebytes has released a Telecrypt Ransomware Decrypter Tool to decrypt files infected with the Telecrypt Ransomware. Download it here.

38] Michael Gillespie, a ransomware researcher has released these ransomware decryptor tools:

Aurora Ransomware Decrypter, FilesLocker Ransomware Decrypter, InsaneCrypt Decryptor for desuCrypt Ransomware, GIBON Ransomware Decryptor, Striked Ransomware Decrypter, DCry Ransomware Decrypter, BitKangaroo Decrypter, BTCWare Ransomware Decrypter, Crypt38 Ransomware Decrypter, BitStak Ransomware Decrypter, Alpha Ransomware Decryptor, Unlock92 Ransomware Decrypter, Hidden Tear Ransomware Decrypter, Hidden Tear Brute Forcer Ransomware decryptor, PowerWare Locky Ransomware Decrypter, GhostCrypt Ransomware Decrypter, MicroCopy Ransomware Decryptor, Jigsaw Ransomware Decrypter.

Plus he has also released the following useful tools:

  1. StupidDecryptor decrypts files encrypted by various screenlockers that are fairly easy to decrypt
  2. RansomNoteCleaner can be used to scan a ransomware victim’s computer for left over ransom notes and delete them
  3. CryptoSearch cleans up your computer of encrypted files and ransom notes from a ransomware infection.

39] Master Key for TeslaCrypt ransomware has been released. Tesladecrypt from Intel will decrypt TeslaCrypt encrypted files with the following extensions: .mp3, .micro, .xxx, and .ttt.

40] BTCWareDecrypter will decrypt files encrypted by BTCWare Ransomware. Get it here.

41] 360 Ransomware Decryption Tool can decrypt files locked by over 80 ransomware including GandCrab, Petya, Gryphon, GoldenEye and WannaCry ransomware.

42] Under favorable conditions, WannaKey and WanaKiwi, two WannaCrypt decryption tools can help decrypt WannaCrypt or WannaCry Ransomware encrypted files by retrieving the encryption key used by the ransomware.

43] Crysis Decrypting Tools have been developed by Eset as well as Avast.

44] The ransomware decryptor tool from QuickHeal will decrypt files locked by the following ransomware –

Troldesh Ransomware [.xtbl], Crysis Ransomware [.CrySiS], Cryptxxx Ransomware [.crypt], Ninja Ransomware [@aol.com$.777], Apocalypse Ransomware [.encrypted], Nemucod Ransomware [.crypted], ODC Ransomware [.odcodc], LeChiffre Ransomware [.LeChiffre], Globe1 Ransomware [.hnyear], Globe2 Ransomware [.blt], Globe3 Ransomware [.decrypt2017], DeriaLock Ransomware [.deria], Opentoyou Ransomware [.-opentoyou@india.com], Globe3 Ransomware [.globe & .happydayzz], Troldesh Ransomware [.dharma], Troldesh Ransomware [.wallet], Troldesh Ransomware [.onion].

Download it here.

45] Ransomware Removal & Response Kit is not a tool, but a compilation of guides and various resources relating to dealing with ransomware, that can prove to be of help. It is a 500 MB download. Read more about it here.

46] Generally speaking, Anvi Rescue Disk can come to your rescue as it can help you uninstall & remove Ransomware.

All the best!

If you have any more free ransomware decryptor tools to add, please do so in the comments section, linking to their official home or download page.

This post talks a little more about Ransomware Attacks & other FAQ.

Updated on 14th July 2019.

Posted by on , in Category Security with Tags
Anand Khanse is the Admin of TheWindowsClub.com, a 10-year Microsoft MVP Awardee in Windows (2006-16) & a Windows Insider MVP. Please read the entire post & the comments first, create a System Restore Point before making any changes to your system & be careful about any 3rd-party offers while installing freeware.

67 Comments

  1. Stephen

    still no chance for teslacrypt 3.0/4.0

  2. Heinz

    With all the goodwill in the world I can not see how ‘Anvi Rescue Disk’ can do any good fighting today’s Ransomware. It is more than 3 years old, and has never been updated. There appeared an awful lot of new Ransomware during that time. I doubt that it can deal with threats that did not exist in 2013.
    I have downloded it, and will try it – with a healthy dose of doubt.

  3. Cihan Erdem

    now you can decrypt teslacrypt 3.0/4.0

  4. Stephen

    yah I have unlocked all 3 days ago

  5. Martin Barsberg

    Any solution when infected with CERBER ransomware?

  6. Todd Jackson

    notihng available yet for Mobef ransomware?

  7. marco

    Any luck to decrypt files that have been renamed to numbers.locky? All my documents and photos are now all renamed with numbers and the extension is .locky. Any help is gretly appreciated

  8. Bala

    Hi – All my files have been encrypted and the names have been changed with the extension .crypz (for eg, 123.jpg.crypz ). I do not have the original files and do not have any back up either. Are the any chances to decrypt the files or restore the original – without making payment to the cyber criminals ?

  9. It is probably the CryptXXX rasomware. To the best of my knowledge, currently there is no way known to recover the files encrypted by the CryptXXX 3.0 ransomware. But you could research a bit and see if you are able to recover some of your siles using some File Recovery software, and keep an eye out for any new decryptor tool that may be released.

  10. Bala

    Sure. Thank you, Anand.

  11. Banu

    any solutions for TrueCrypter / .enc files?

  12. Deepranjan

    somebody please find a solution for cerber ransomware. the file extension is .cerber / .cerber2

  13. rahul jain

    any decreptor for .cerber2 extension?
    all my important data is encrypted and i have no backup please help!!

  14. Nope. None as of date. 🙁

  15. rahul jain

    Anand Sir Can you please tell should i wait for the decryptor or format my pc??

  16. As I said, too bad this happened: http://news.thewindowsclub.com/cerber-ransomware-fixes-encryption-flaw-makes-decryption-tool-useless-85626/ Mow no saying when its Decryptor will be released – so if you cannot wait, best to format your PC.

  17. James454

    is there a decryptor available already with a .cerber3 file extension??? plsssss reply thx!

  18. James454

    man what should i do now? i cannot open my files 🙁 thanks for the reply! btw

  19. Your best option is to format your PC and restore your files from a backup. Else search for “.cerber3 removal” on the web, but I am not sure if they really work. Or else pay them :(. Perhaps this may help you: http://www.bleepingcomputer.com/forums/t/606583/cerber-ransomware-support-and-help-topic-decrypt-my-files-htmltxtvbs/

  20. Pravin Gaikwad

    can you please provide decryptor for .fantom

  21. None released so far for this one.

  22. Thomas Maher

    iolo system shield been deleting pictures on me saying infected with locky.eric and idk why as full scan finds 0 infections. I not done anything that would get me infected

  23. Thomas Maher

    use comodo rescue disc

  24. Rob H

    I have recently had the same problem 9/19 – 9/22 via the Iolo system shield real-time software and as you running the full scan says zero infections. I have logged a case with IoLo and sent a screen snap of the files in quarantine… called lockyeric.A.|camelot

  25. Thomas Maher

    Sadly Ihave it set to delete them when found though some reason it quarantine 2 pictures today and idk why they were not deleted. Please let me know the results. I got them all on another computer that not on currently so don’t want to turn it on to have them deleted on me

  26. Sushil Pande

    cerber3 affected files how to?

  27. Sushil Pande

    any support

  28. John

    is there any tool for Cerber?

  29. That is the Troldesh/Shade ransomware. There is no decryptor available for it at the moment, but you may try and use ShadowExplorer or some free File Recovery Software to restore your data.

  30. Cihan Erdem

    i can help you for your .encrypted and .enc extension files.

  31. David A

    Hi, anyone has any idea to decrypt “.lock” files? I’ve got samples of all relevant files associated of the ransonware. The executable files and etc. Thanks

  32. andriod

    what about LOCKY or odin ransomware?? no tools for decryption???

  33. Locky ransomware morphed into Zepto and Odin is its latest avatar. No specific tool available, but you may try No. 1 in the list for Locky.

  34. Thomas Maher

    Problem been fixed I contacted them and told them about it to let them know.

  35. siddharth shah

    hello sir,
    if you find one please inform me at “siddharths827@gmail.com”
    thank you

  36. Vladimir

    Is there any luck with DAVINCI CODE ransomware???

  37. That is the Troldesh ransomware. There is no decryptor available for it at the moment, but you may try and use ShadowExplorer or some free File Recovery Software to restore your data.

  38. fenice80

    I have .enc files. Can you help me pls ? panacea_italia@msn.com

  39. make2k

    Hi. Where i can find CryptoLocker ( 3.0 ) Decryption Tool?

  40. make2k

    that f***ing thing locked my over 80000 mp3 files 🙁

  41. hamza

    i have a no more ransom encryption .I believe it is called troldesh / shade so could you help me or any advice and thank you

  42. Windows Defender claims to remove Troldesh. https://www.microsoft.com/security/portal/threat/Encyclopedia/Entry.aspx?Name=Ransom:Win32/Troldesh.A Use Windows Defender Offline Tool. Also try Kaspersky Shade Decryptor.

  43. Mike S

    what if you have had pclock variant of Cryptolocker and had to reformat and reinstall the operating system but still have encrypted files on other drives is there any way to get those decrypted?

  44. Rishal

    Any decrypter for spora ransomware

  45. As of date there is no way to restore Spora encrypted files.

  46. Rishal

    Sad to hear that… Read that the spora ransomware creates duplicate files and encrypt that file and deletes the original final….. Any possibilities of using any softwares to retrieve deleted items?

  47. digital bullet

    I have 2 drives with files that were encrypted with cryptowall 2.0. Any chance a decryption tool out for this? Please help. I have my kids photo’s, thousands of them that I cannot open. ccoaston@live.com if you would like to contact me.

  48. ???????????? ??????????

    Any decryptor for Sage 2.2?

  49. Panayiotis Argyrou

    Hi we had an attack from Ransom and one of the files not backup was renamed from AEMPY.db to AEMPY.db.ID-DA15AE27GR[crypt32@mail.ru].ngayadgaoaa

    Can anyone help how to decrypt it. It is a very important database.

    thanks,

    Panos (kipreos2012@gmail.com)

  50. Sudan Maharjan

    Is there any hope/tools to decrypt files that are damaged by cryptolocker. Any help would be appriciated

  51. Juan Figueroa

    Any decryptor in the horizon for the WannaCryWannacryptor?

  52. Nothing for the moment …..

  53. caroline

    is there a decryptor for Cryptowall yet?

  54. Asma Zahmoul

    Hi any hope for Cryptolocker victims ? what tool can I try from this list ,, it seems like option 3 is no longer available 🙁

  55. Hailey Moore

    I started using security software few weeks ago. I actually didn’t know what it does but my brother explained it to me and since ransomware is so “popular” now, and more and more people complain about their files getting encrypted I got scared. But this new product already has two versions, Ransomware Shield 1.1 and Ransomware Shield 1.2! It’s called Impedio Security, they have website, facebook, even youtube channel so you can see how intelligent this software is and how easy it is to protect your data!

  56. hesham hassan

    sage 2.2 please help me

  57. dansama

    anyone see a variant with .AES? There wasnt a ransom HTML or a virus we can see just a text file called Instruction.txt “Hi all your files are encrypted, to decrypt all your files write to us on the mail:…”

  58. Sumit Sen

    Hi, does anyone know where i can get a decryptor tool for .Java file ransomware (.id-BAE388D2.[stronman@cock.li].java).

  59. krishna

    gandcrab decryption tool

  60. krishna

    if any one know about gandcrab decryption tool

  61. ??? ????

    How about dharma with java basic (.cvvvi), all of file has convert to .js

  62. ??? ????

    Please help for answer to adamdua91@gmail.com

Leave a Reply

Your email address will not be published. Required fields are marked *


8 + 5 =