---
reference:
  js:
    - key: decrypt
      id: decrypt_data
      url: /reference/vault/key/decrypt-data
      title: vault.decrypt()
      parameters:
        - key: encryptedData
          type: string
          description: (data_encryption.ciphertext)
        - key: associatedData
          type: string
          optional: true
          description: (data_encryption.aad)
      returns:
        - key: data
          type: string
          description: (data_encryption.plaintext)
  go:
    - key: Decrypt
      id: decrypt_data
      url: /reference/vault/key/decrypt-data
      title: vault.Decrypt()
      parameters:
        - (ctx)
        - key: opts
          type: vault.DecryptOpts
          expanded: true
          properties:
            - key: Data
              type: string
              description: (data_encryption.ciphertext)
            - key: AssociatedData
              type: string
              optional: true
              description: (data_encryption.aad)
            - key: NonceSize
              type: int
              optional: true
              description: >-
                Number of bytes to use for a random nonce. Must be either 12
                (default) or 32 (supported for backwards compatibility). No
                other values are valid.
      returns:
        - key: plaintext
          type: string
          description: (data_encryption.plaintext)
  python:
    - key: decrypt
      id: decrypt_data
      url: /reference/vault/key/decrypt-data
      title: vault.decrypt()
      parameters:
        - key: encrypted_data
          type: str
          description: (data_encryption.ciphertext)
        - key: associated_data
          type: str
          optional: true
          description: (data_encryption.aad)
      returns:
        - key: plaintext
          type: str
          description: (data_encryption.plaintext)
originalPath: .tmp-workos-clone/packages/docs/content/reference/vault/key/decrypt-data.mdx
---

## Decrypt data

Decrypt data that was previously encrypted with Vault. The data key in the ciphertext is decrypted using the Vault API and used to decrypt the remaining data. The decryption operations happen locally and neither the plaintext nor encrypted data are sent over the network.

<CodeBlock referenceId="decrypt_data">
  <CodeBlockTab title="Request" file="decrypt-data-request" />
  <CodeBlockTab title="Response" file="decrypt-data-response" />
</CodeBlock>