Free Ransomware Decryptors Collection [Updated 2020]

Ransomware attacks can be crippling if they happen to you. If you’re hit by ransomware, don’t pay the ransom. Use these ransomware decryptors, backups, and other tools to start recovery. Here is a list of steps you need to take:

  1. Download our ransomware response kit
  2. Identify your ransomware variant by visiting ID Ransomware
  3. Utilize the free ransomware decrypter decryptortools listed below
  4. Try to restore from a backup
  5. Protect yourself from future attacks with CryptoStopper™

The Definitive Collection of Ransomware Decryption Tools on the Web

We have scoured the web and created the largest collection of ransomware decryptors and decryption tools available. These tools may help you to decrypt your files without having to pay the ransom. This list is updated regularly so if the decrypter or tool you need isn’t available check back in the future and it may be available.

Feel free to contact us if you have questions about these tools or have been subject to an attack and need help figuring out what to do next.

Decryptor DownloadRead MeEncrypted File ExtensionCreator/Contributor
CuteInstructionsaaaddress1
my-Little-RansomwareInstructionsaaaddress1
AES_NIInstructions*.aes_ni, *.aes256, *.aes_ni_0dayAvast
Alcatraz LockerInstructions*.AlcatrazAvast
ApocalypseInstructions*.encrypted, *.FuckYourData, *.locked, *.Encryptedfile, *.SecureCryptedAvast
ApocalypseVMInstructions*.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCryptedAvast
BadBlockInstructionsDoesn't change file extension. Look for BadBlock in ransom note (32-Bit)Avast
BadBlockInstructionsDoesn't change file extension. Look for BadBlock in ransom note (64-Bit)Avast
BartInstructions*.bart.zipAvast
BigBobRossInstructions*.obfuscatedAvast
BTCWareInstructions*.btcware, *.cryptobyte, *.cryptowin, *.theva, *.onyonAvast
Crypt888InstructionsThis ransomware adds Lock. to the beginning of file namesAvast
CryptFile2Instructions*.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd*.rsclAvast
CryptoMix (Offline)Instructions*.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd*.rscl, *.MOLEAvast
CryptoShieldInstructions*.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd*.rscl, *.MOLEAvast
ZetaInstructions*.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd*.rsclAvast
CrysisInstructions*[email protected], *[email protected], *[email protected], *[email protected], *.{[email protected]}.CrySiS, *.{[email protected]}.xtbl, *.{[email protected]}.xtbl, *.{[email protected]}.xtbl, *.{[email protected]}.dharma, *.{[email protected]}.dharma, *.walletAvast
EncrypTileInstructionsThe ransomware adds the word "encryptTile" into a file nameAvast
EncrypTileInstructions*.EncrypTileAvast
FindZipInstructions*.cryptAvast
GandCrabInstructions*.GDCB, *.CRAB, *.KRAB, *.%RandomLetters%Avast
GlobeInstructions*.ACRYPT, *.GSupport[0-9], *.blackblock, *.dll555, *.duhust, *exploit, *.frozen, *.globe, *.gsupport, *.kyra, *.purged, *.raid[0-9], *[email protected], *.xtlb, *.zendrz, *.zendr[0-9], *.hnyearAvast
HiddenTearInstructions*.locked, *.34xxx, *.bloccato, *.BUGSECCCC, *.Hollycrypt, *.lock, *.saeid, *.unlockit, *.razy, *.mecpt, *.monstro, *.lok, *.암호화됨, *.8lock8, *.fucked, *.flyper, *.kratos, *.drypted, *.CAZZO, *.doomedAvast
JigsawInstructions*.kkk, *.btc, *.gws, *.J, *.encrypted, *.porno, *.payransom, *.pornoransom, *.epic, *.xyz, *.versiegelt, *.encrypted, *.payb, *.payb, *.pays, *.payms, *.paymds, *,paymts, *.payrms, *.payrmts, *.paymrts, *.paybtcs, *.fun, *.hush, *[email protected], *.geficktAvast
LambdaLockerInstructions*.MyChemicalRomance4EVERAvast
LegionInstructions*[email protected]$.legion, *[email protected]$.cbfAvast
NoobCryptInstructionsNoobCrypt doesn't change the file name. Leaves "ransomed.html" messageAvast
StampadoInstructions*.lockedAvast
SZFLockerInstructions*.szfAvast
TeslaCryptInstructionsThe latest version of TeslaCrypt doesn't rename files. Avast
XDataInstructions*.~xdata~Avast
ApocalypseInstructions*.encrypted, *.FuckYourData, *.locked, *.Encryptedfile, *.SecureCryptedAVG
ApocalypseVMInstructions*.encrypted, *.FuckYourData, *.locked, *.Encryptedfile, *.SecureCryptedAVG
BadBlock 32-BitInstructionsDoesn't change file extension. Look for BadBlock in ransom noteAVG
BadBlock 64-BitInstructionsDoesn't change file extension. Look for BadBlock in ransom noteAVG
BartInstructions*.bart.zipAVG
Crypt888InstructionsThis ransomware adds Lock. to the beginning of file namesAVG
MirCopInstructionsLock.{Original file name}AVG
LegionInstructions*[email protected]$.legion, *[email protected]$.cbf or *[email protected]$.cbf to end of filenameAVG
SZFLockerInstructions*.szfAVG
TeslaCryptInstructionsDecryptor for variant that doesn't rename filesAVG
AnnabelleInstructions*.ANNABELLEBitDefender
Bart*.BartBitDefender
GandCrab (V1, V4 and V5 up to V5.2 versions)Instructions*.GDCB, *.CRAB, *.KRAB, *.%RandomLetters%BitDefender
Juicy LemonInstructions*.id-{number}[email protected]Bleeping Computer
PizzaCryptsInstructions*.id-{number}_, .id-{number}[email protected], .id-{number}_*@juicylemon.biz*protonmail.com*, .id-{number}_*@juicylemon.biz_BitMessage_*Bleeping Computer
ODCODCInstructions*.odcodcBleeping Computer
CryptorbitInstructionslocks files and creates HowDecrypt.txt and HowDecrypt.gifBleeping Computer
Operation Global IIIInstructions*.exeBleeping Computer
BitStakInstructions*.bitstakBleeping Computer
GhostCryptInstructions*.Z81928819Bleeping Computer
JigsawInstructions*.FUN, *.KKK, *.GWS, *.BTCBleeping Computer
Princess LockerInstructionsRansomware appends random characters to the file extensionBleeping Computer
AuroraInstructions*.NanoBleeping Computer
FilesLocker v1 and v2Instructions*.[[email protected]]Bleeping Computer
EverbeInstructions*.insane, *.DUESCRYPT, *.deuscrypt, *.Tornado, *.twist, *.everbe, *.embrace, *.pain, *.volcanoBleeping Computer
InsaneCryptInstructions*.[[email protected]].everbe, *.embrace, *.painBleeping Computer
AnnabelleInstructions*.ANNABELLEBleeping Computer
CryptoDevilInstructions*.devilBleeping Computer
ZykaInstructions*.lockBleeping Computer
Unlock92Instructions*.CRRRTBleeping Computer
CryptoHostCryptoHostDetected as Ransom:MSIL/Manamecrypt.A and Ransom_CRYPTOHOST.A.Bleeping Computer
TorrentLockerInstructions*.encrypted, *.encBleeping Computer
AlphaInstructions*.encryptBleepingComputer
BitKangarooInstructions*.bitkangarooBleepingComputer
Crypt38Instructions*.crypt38BleepingComputer
DCryInstructions*.dcryBleepingComputer
MicroCopInstructionsAdds Locked to the beginning of your encrypted filesBleepingComputer
Mole02InstructionsN/ABleepingComputer
Offline CryptoMixInstructions*.CRYPTOSHIELD, *.scl, *.rscl, *.lesli, *.rdmk, *.code, *.rmdBleepingComputer
PowerLockyInstructions*.lockyBleepingComputer
StrikedDecrypterInstructions*[email protected],*[email protected], *[email protected], *[email protected], *[email protected], *[email protected], *[email protected]BleepingComputer
AnDROidInstructions*.androidBleepingComputer
Anti-DDosInstructions*.f*ckedBleepingComputer
Crypt0Instructions*_crypt0BleepingComputer
Crypto-BlockerInstructions*.corruptedBleepingComputer
CryptoLocker by NTKInstructions*.pownedBleepingComputer
CryptoSomwareInstructions*.FailedAccessBleepingComputer
DeriaLockInstructions*.deriaBleepingComputer
DoNotOpenInstructions*.killedXXXBleepingComputer
EnkripsiPCInstructions*.bleepedBleepingComputer
F*ckTheSystemInstructions*.anonBleepingComputer
HarzhuangziInstructions*.HarzhuangziBleepingComputer
HatersInstructions*.hatersBleepingComputer
HitlerInstructions*.NaziBleepingComputer
JeepersCryptInstructions*.jeepersBleepingComputer
ManifestusInstructions*.f*ckedBleepingComputer
MikoyanInstructions*.MIKOYANBleepingComputer
NullByteInstructions*._nullbyteBleepingComputer
SnakeEyeInstructions*.SnakeEyeBleepingComputer
XncryptInstructions*.xncryptBleepingComputer
MoleInstructions*.moleCERT-PL
BarRaxInstructions*.barraxCheck Point
Merry X-MasInstructions*.PEGS1, *.MRCR1, *.RARE1, *.MERRY, *.RMCM1Check Point
JigsawInstructions*.FUN, *.KKK, *.GWS, *.BTCCheck Point
PylockyInstructionsRANSOM_PYLOCKY.ACisco
TeslaCryptInstructions{original file name}.ECCCisco
ThanatosInstructions*.THANATOSCisco
NanolockerInstructionsCyberclues
PopcornInstructions*.filockElevenpaths
Decrypt ProtectInstructions*.htmlEmsisoft
777Instructions*.777Emsisoft
Al-NamroodInstructions*.unavailable, *.disappearedEmsisoft
Amnesia2Instructions*.amnesiaEmsisoft
ApocalypseInstructions*.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCryptedEmsisoft
ApocalypseVMInstructions*.encrypted, *.lockedEmsisoft
AuroraInstructions*.Aurora, *.aurora, *.animus, *.cryptoid, *.peekaboo, *.isolated, *.infected, *.lockedEmsisoft
AutoLockyInstructions*.lockyEmsisoft
BadBlockInstructionsDoesn't change file extension. Look for BadBlock in ransom noteEmsisoft
Cry128Instructions*.fgb45ft3pqamyji7.onion.to._ or *.id__gebdp3k7bolalnd4.onion._' or *.id__2irbar3mjvbap6gt.onion.to._ or *.id-_[qg6m5wo7h3id55ym.onion.to].63vc4Emsisoft
Cry9Instructions*.fgb45ft3pqamyji7.onion.to._, 8.id__gebdp3k7bolalnd4.onion._, *.id__2irbar3mjvbap6gt.onion.to._, *.id-_[qg6m5wo7h3id55ym.onion.to].63vc4Emsisoft
CrypBossInstructions*.crypt, *.R16M01D0Emsisoft
CryptInfiniteInstructions*.CRINFEmsisoft
CryptoDefenseInstructionsIdentifes as CryptoDefense leaves note HOW_DECRYPT.txtEmsisoft
CryptonInstructions*.id-_locked, *.id-_locked_by_krec, *.id-_locked_by_perfect, *.id-_x3m, *.id-_r9oj, *[email protected], *[email protected]_, *[email protected]_, *[email protected]_, *[email protected]_,*[email protected]_Emsisoft
DamageInstructions*.damageEmsisoft
DMALockerInstructionsDMALocker with ID “DMALOCK 41:55:16:13:51:76:67:99Emsisoft
DMALocker2InstructionsDMALocker2 with ID “DMALOCK 43:41:90:35:25:13:61:92Emsisoft
FabiansomwareInstructions*.encryptedEmsisoft
FenixLockerInstructions*[email protected]!!Emsisoft
GetCryptInstructionsAppends a random 4-character extension to filesEmsisoft
GlobeInstructions*.purge, *.globe, *[email protected].!dsvgdfvdDVGR3SsdvfEF75sddf#xbkNY45fg6}P{cg.xtbl.Emsisoft
Globe2Instructions*.raid10, *.blt, *.globe, *.encrypted,*[[email protected]]Emsisoft
Globe3Instructions*.decrypt2017, *.hnumkhotepEmsisoft
GlobeImposterInstructions*.cryptEmsisoft
GomasomInstructions*.cryptEmsisoft
HarasomInstructions*.html and note from Spamhaus or US Department of JusticeEmsisoft
HKCryptInstructions*.hackedEmsisoft
HydraCryptInstructions*.hyrdacrypt, *.umbrecryptEmsisoft
UmbreCryptInstructions*.hydracrypt, *.umbrecryptEmsisoft
ImS00rryInstructionsEmsisoft
JSWorm 4.0Instructions*.[ID-9LF5BNP][[email protected]].JSWRMEmsisoft
JSWormInstructions*.[ID.194958][[email protected]].JSWORMEmsisoft
KeyBTCInstructionsLeaves ransom note called Decrypt_Your_Files.txt on your system that asks you to contact [email protected] for decryption.Emsisoft
LeChiffreInstructions*.LeChiffre and the ransom note asks you to contact [email protected] via email.Emsisoft
Instructions*.lcphrEmsisoft
MarlboroInstructions*.oopsEmsisoft
MegaLockerInstructions*.nampohyuEmsisoft
MRCR or Merry X-MasInstructions*.PEGS1, *.MRCR1, *.RARE1, *.MERRY, *.RMCM1Emsisoft
NemucodInstructions*.crypted and you find a ransom note named DECRYPT.txt on your desktop.Emsisoft
NemucodAESInstructionsDoes not change file extension and a ransom note named "DECRYPT.hta" can be found on your desktop.Emsisoft
NMoreiraInstructions*.maktub, *._AiraCropEncrypted!Emsisoft
OpenToYouInstructions*[email protected]Emsisoft
OzozaLockerInstructions*.locked With a ransom note named "HOW TO DECRYPT YOU FILES.txt" on your desktop. Note is from [email protected]Emsisoft
PClockInstructionsDoesn't change extension look for enc_files.txtEmsisoft
PewcryptInstructions*.PewCryptEmsisoft
PhiladelphiaInstructions*.lockedEmsisoft
PlanetaryInstructions*.miraEmsisoft
RadamantInstructions*.rdm, *.rrkEmsisoft
StampadoInstructions*.locked Known variants of this ransomware ask victims to contact [email protected], [email protected], [email protected], [email protected] or [email protected]Emsisoft
SyrkInstructions*.SyrkEmsisoft
XoristInstructions*.EnCiPhErEd, *.0JELvV, *.p5tkjw, *.6FKR8d, *.UslJ6m, *.n1wLp0, *.5vypSa, *.YNhlv1Emsisoft
ZQInstructions*.zqEmsisoft
WannaCryFakeInstructions*.wannacryEmsisoft
AvestInstructions*.ckey().email().pack14Emsisoft
TeslaCryptInstructions*.xxx, *.ttt, *.micro, *.mp3ESET
VirlockInstructions*.exeESET
CrysisInstructions*.xtbl, *.crysis, *.crypt, *.lock, *.crypted, *.dharma, *.wallet, *.onionESET
SimplockerInstructionsESET
TrustezebInstructionsESET
MiraInstructions*.miraF-Secure
TeslaCryptInstructions*.vvv, *.ccc, *.zzz, *.aaa, *.abcGoogulator
7even-HONE$TPython Script{sequential number}.R4A or{sequential number}.R5Ahasherezade
BitcryptorInstructions.cvlstKaspersky
Agent.iihInstructionsKaspersky
AuraInstructionsKaspersky
AutoITInstructions{Original Filename}@<mail server>_.<random_set_of_characters>.Kaspersky
AutoLTInstructionsRenames files "<original_name>@<mail server>_.<random_set_of_characters>"Kaspersky
Bitman v.3Instructions*.xxx, *.ttt, *.micro, *.mp3Kaspersky
Bitman v.4InstructionsDoes not change file extension.Kaspersky
CerberInstructions{10 random characters}.cerberKaspersky
ChimeraInstructions{Original file name}.cryptKaspersky
CryptokluchenInstructionsKaspersky
CrysisInstructionsid}.{email address}.xtbl, cryptKaspersky
DemocryInstructions*._date-time_$address@domain$.777 OR *._date-time_$address@domain$.legionKaspersky
DharmaInstructions*.walletKaspersky
JaffInstructions*.JaffKaspersky
LamerInstructionsKaspersky
LobzikInstructions*.fun, *.gws, *.btc, *.AFD, *.porno, *.pornoransom, *.epic, *.encrypted, *.J, *.payransom, *.paybtcs, *.paymds, *.paymrss, *.paymrts, *.paymst, *.paymts, *.payrmsKaspersky
LortokInstructions*.crimeKaspersky
PletorInstructionsKaspersky
RakhniInstructions*.locked, *.krakenKaspersky
RotorInstructions*[email protected]____.tar, *[email protected]____.tarKaspersky
TeslaCrypt v3Instructions{original file name}.XXX or TTT or MP3 or MICROKaspersky
TeslaCrypt v4InstructionsFile name and extension are unchangedKaspersky
XDataInstructions*.~xdata~Kaspersky
AutoLTInstructionsRenames files "<original_name>@<mail server>_.<random_set_of_characters>"Kaspersky
CryaklInstructionsInfected with Trojan-Ransom.Win32.Cryakl (also tags end of file name with{CRYPTENDBLACKDC})Kaspersky
CrybolaInstructionsInfected with Trojan-Ransom.Win32.CrybolaKaspersky
CryptXXX v1Instructions{original file name}.crypt, cryp1, crypz, or 5 hexadecimal charactersKaspersky
CryptXXX v2Instructions{original file name}.crypt, cryp1, crypz, or 5 hexadecimal charactersKaspersky
CryptXXX v3Instructions{original file name}.crypt, cryp1, crypz, or 5 hexadecimal charactersKaspersky
FuryInstructionsInfected with Trojan-Ransom.Win32.FuryKaspersky
MarsjokeInstructions*.a19 or *p19Kaspersky
PolyglotInstructionsInfected with Trojan-Ransom.Win32.PolyglotKaspersky
RannohInstructionsRenames files "locked-<original_name>.<four_random_letters>"Kaspersky
ShadeInstructions*.xtbl, *.ytbl, *.breaking_bad, *.heisenbergKaspersky
WildfireInstructions*.wflxKaspersky
XoristInstructions*.xorist (or adds a random extension)Kaspersky
RectorInstructionsTrojan-Ransom.Win32.RectorKaspersky
ScraperInstructionsTrojan-Ransom.Win32.ScraperKaspersky
CrysisInstructions*[email protected], *[email protected], *[email protected], *[email protected], *.{[email protected]}.CrySiS, *.{[email protected]}.xtbl, *.{[email protected]}.xtbl, *.{[email protected]}.xtbl, *.{[email protected]}.dharma, *.{[email protected]}.dharma, *.walletKaspersky
CoinVaultInstructions*.cvlstKaspersky
FortuneCryptInstructionsKaspersky
YatronInstructions*.yatronKaspersky
PetyaInstructionsleo-stone
TeslaCryptInstructions*.xxx, *.ttt, *.micro, *.mp3McAfee
TeslaCrypt V3Instructions*.mp3, *.micro, *.xxx, *.tttMcAfee
PoshCoderPoshCoder*.lockypan-unit42
CryprenInstructions*.encryptedpekeinfo
AlmaInstructionsAdds 5 random characters at the end of each file and a unique 8 character victim IDPHISHLABS
Lock Screen USBInstructionsLockscreen ransomwareTrend Micro
Lock ScreenInstructionsLockscreen ransomwareTrend Micro
777Instructions{Original file name}.777Trend Micro
AutoLockyInstructions{Original file name}.lockyTrend Micro
Cerber .v1Instructions{10 random characters}.cerberTrend Micro
ChimeraInstructions{Original file name}.cryptTrend Micro
DemoToolInstructions*.demoadcTrend Micro
DXXD v.1Instructions{Original file name}.{Original extension}dxxdTrend Micro
Globe .v1Instructions{Original file name}.purgeTrend Micro
Globe .v2Instructions{Original file name}.{email address + random characters}Trend Micro
Globe v.3InstructionsExtension not fixed or file name encryptedTrend Micro
JigsawInstructions*.FUN, *.KKK, *.GWS, *.BTCTrend Micro
LeChiffreInstructions{Original file name}.LeChiffreTrend Micro
MirCopInstructionsLock.{Original file name}Trend Micro
NemucodInstructions{Original file name}.cryptedTrend Micro
Purge v.1Instructions{Original file name}.purgeTrend Micro
Purge v.2Instructions{Original file name}.{email address + random characters}Trend Micro
Purge v.3Instructions{Original file name}.{email address + random characters}Trend Micro
SNSLockerInstructions{Original file name}.RSNSLockedTrend Micro
StampadoInstructions*.lockedTrend Micro
TeamxratInstructions{Original filename}.__xratteamLuckedTrend Micro
TeleCryptInstructions{Original file name}Trend Micro
TeslaCrypt v3Instructions{original file name}.XXX or TTT or MP3 or MICROTrend Micro
TeslaCrypt v4InstructionsFile name and extension are unchangedTrend Micro
XORBATInstructions{Original file name}.cryptedTrend Micro
XoristInstructions*.xorist (or adds a random extension)Trend Micro
XpanInstructions{Original filename}.__xratteamLuckedTrend Micro
Instructions{original file name}.ECCTrend Micro
BadBlockInstructionsDoesn't change file extension. Look for BadBlock in ransom noteTrend Micro
MacRansomInstructionsTrend Micro
777Instructions*.777Trend Micro
CryptXXX v1Instructions{original file name}.crypt, cryp1, crypz, or 5 hexadecimal charactersTrend Micro
CryptXXX v2Instructions{original file name}.crypt, cryp1, crypz, or 5 hexadecimal charactersTrend Micro
CryptXXX v3Instructions{original file name}.crypt, cryp1, crypz, or 5 hexadecimal charactersTrend Micro
CryptXXX v4Instructions*.5 hexadecimal charactersTrend Micro
CryptXXX v5Instructions*.5 hexadecimal charactersTrend Micro
CrysisInstructions*[email protected], *[email protected], *[email protected], *[email protected], *.{[email protected]}.CrySiS, *.{[email protected]}.xtbl, *.{[email protected]}.xtbl, *.{[email protected]}.xtbl, *.{[email protected]}.dharma, *.{[email protected]}.dharma, *.walletTrend Micro
TeslaCrypt V2Instructions{original file name}.VVV, CCC, ZZZ, AAA, ABC, XYZTrend Micro
XRatTeamInstructions*.xratteamLuckedTrend Micro

Ransomware Decryptors List

Find the latest decryption tools, ransomware decryptors, and information on ransomware protection.

What is ransomware? It’s a malware (a Trojan or another type of virus) that locks your device or encrypts your files, and then tells you that you have to pay ransom to get your data back. It’s not cheap, and there’s no guarantee of success. If you become a victim of ransomware, try our free decryption tools and get your digital life back.

These tools can be complicated, so contact us with any questions you have and we’ll be happy to help.

Click on each tool to read more about it and get instructions on how to download and use.

ransomware decryptors