A simple encryption/decryption using CryptoJS gives me a weird output. Can anyone point me to where the code is wrong? (I'm looking for the output in the console)

var code = "Testcode";
var diterations = 1000;
var defaultkeyBytes = new CryptoJS.PBKDF2(code, code, { hasher: CryptoJS.algo.SHA512, keySize: 48 / 4, iterations: diterations });
var key = new CryptoJS.lib.WordArray.init(defaultkeyBytes.words, 32);
var iv = new CryptoJS.lib.WordArray.init(defaultkeyBytes.words.splice(32 / 4), 16);
var data = "test message new test message";
var h = CryptoJS.AES.encrypt(data, key, { iv: iv, mode: CryptoJS.mode.CBC });
var z = CryptoJS.AES.decrypt(h, key, { iv: iv, mode: CryptoJS.mode.CBC });

Output :

"Running fiddle"

"qx84iCiNL1YYWJhE6nG8KZxOCh4VGOBTaeCEAjy1P+s=" "74657374206d657373616765206e65772074657374206d657373616765"


  • Salt should be unique (usually random) when reusing a passphrase, although for CBC it's not as insecure as keystream modes like OFB or CTR. Jun 22, 2022 at 2:30

1 Answer 1


Details about the decryption/encryption output can be found on the documentation page for CryptoJS: Cipher Output.


As @dave_thompson_085 says in his comment, the output you see from h.toString() is a CipherParams object whose formatting defaults to base64, but whose WordArray components can be separated.

> data = "qx84iCiNL1YYWJhE6nG8KZxOCh4VGOBTaeCEAjy1P+s="
> base64.b64decode(data)


It's working it's just a HexString that is being output. Quick Python code to show it.

> from binascii import unhexlify
> unhexlify("74657374206d657373616765206e65772074657374206d657373616765")
b'test message new test message'

The decryption output is a WordArray. The toString() method prints the full HexString instead of an array of 32-bit values. The z object itself decrypted correctly.

  • Excellent .thankyou.. so I guess I need to convert from hex to ascii or utf8 string
    – newbie
    Jun 21, 2022 at 13:32
  • @newbie Yes that would be correct. There might also be an object method for z that will output the string in the form you want. I'm not an expert in CryptoJS's API.
    – RoraΖ
    Jun 21, 2022 at 13:34
  • 1
    cryptojs.gitbook.io/docs/#the-hashing-output (which describes WordArray, the same type used for decrypt output; as described lower on that page, encrypt output is a CipherParams object whose formatting defaults to base64, but whose WordArray components can be separated) Jun 22, 2022 at 2:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .