[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [How to Decrypt Ransomware (with 100% Free Tools)](/blog/how-to-decrypt-ransomware) Publish date December 1, 2025 {x} minute read # How to Decrypt Ransomware (with 100% Free Tools) [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/the-ultimate-ransomware-defense-guide) [Free trial](/demo) Written by [Catherine Chipeta](/team/catherine-chipeta) Cybersecurity Writer Catherine's work has influenced leaders in technology, SaaS, government, and financial services. Reviewed by [Phil Ross](/team/phil-ross) Chief Information Security Officer Phil is a Forrester Zero Trust Strategist leveraging decades of experience in enterprise cybersecurity architectures. Table of contents eBook The Ultimate Ransomware Defense Guide Free resource ### The Ultimate Ransomware Defense Guide [Download now](/resources/the-ultimate-ransomware-defense-guide) ‍[Ransomware attacks ](https://www.upguard.com/blog/wannacry)are dominating news headlines, with [ransomware-as-a-service (RaaS) operators](https://www.upguard.com/blog/what-is-ransomware-as-a-service) actively seeking to [exploit](https://www.upguard.com/blog/exploit) network [vulnerabilities](https://www.upguard.com/blog/vulnerability) and infect unsuspecting victims. The [healthcare sector](https://www.upguard.com/blog/cybersecurity-regulations-and-frameworks-healthcare) and [financial industry](https://www.upguard.com/blog/cybersecurity-regulations-financial-industry) are especially vulnerable to [ransomware attacks](https://www.upguard.com/glossary/ransomware), as they store valuable [personally identifiable data (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii) which can be misused to carry out lucrative crimes, like identity theft and fraud.  During a successful ransomware attack, cyber attackers [encrypt](https://www.upguard.com/blog/encryption) this [sensitive data](https://www.upguard.com/blog/sensitive-data), preventing organizations from accessing it. The attackers then demand a hefty cryptocurrency ransom payment in exchange for a decryption key that provides access to it again.  If your organization is infected by ransomware, time is of the essence to [prevent further data breaches](https://www.upguard.com/blog/prevent-data-breaches). Thankfully, there are now many free decryption tools available to help you defend against [common variants of ransomware](https://www.upguard.com/blog/ransomware-examples). Read on to learn how to decrypt ransomware and prevent future infections through defensive measures.  [*Skip ahead to our list of the top 10 free ransomware decryption tools.*](https://www.upguard.com/blog/how-to-decrypt-ransomware#toc-1) ## How To Recover Data From a Ransomware Attack In the event of a ransomware attack, follow these steps to recover your data. If you’re not sure what ransomware is, [read our guide to ransomware here](https://www.upguard.com/blog/ransomware). ### 1. Find the Source of Infection Ransomware spreads quickly once it has entered a target system. Many ransomware or [malware](https://www.upguard.com/blog/malware) types, such as [cryptoworms](https://www.upguard.com/blog/computer-worm), will actively seek multiple infection points. A fast response is crucial to preventing a [costly data breach](https://www.upguard.com/blog/cost-of-data-breach).  Firstly, you must identify the source of infection and isolate it from all other devices on the network – both physically and electronically.  The isolation process involves: * Unplugging the device’s power source. * Disconnecting the device from Wi-Fi and other network connections. * Removing any connected devices, e.g. external storage.  There’s a high chance that the ransomware has entered through more than one device. You should also treat all devices connected to the first identified source of infection with similar caution and [follow appropriate cybersecurity measures](https://www.upguard.com/blog/reduce-cybersecurity-risk).  ### 2. Identify the Type of Ransomware You're Infected With You’ll need to identify which type of ransomware is infecting your systems to take the most appropriate restorative actions. Kaspersky research shows [ransomware is rapidly evolving](https://backendnews.net/kaspersky-trends-report-shows-evolution-of-ransomware-groups/), with new variants emerging at pace with the growing number of attacks.   While many hackers will identify themselves through the filename of their ransom notes or encrypted files (.exe or .txt). Aside from relying on the file extension, there are also many identification sites now available such as: [Crypto Sheriff](https://www.nomoreransom.org/crypto-sheriff.php?lang=en) and [ID Ransomware](https://id-ransomware.malwarehunterteam.com/index.php). [*Learn more about different types of ransomware.*](https://www.upguard.com/blog/ransomware-examples) ### 3. Report to Law Enforcement Ransomware attackers will demand payment in Bitcoin (or another cryptocurrency) in exchange for a private key to unlock your [encrypted files](https://www.upguard.com/blog/encryption). Most law enforcement agencies urge ransomware victims not to pay the ransom. In many cases, ransom payment only encourages further financial demands and there is no guarantee you will be given access back to your data. Reporting the attack will provide authorities with relevant information to assist in identifying the perpetrators in your case and other similar ransomware attacks. ‍ Learn how to reduce the impact of ransomware attacks. [Read this post >](https://www.upguard.com/blog/protecting-employee-credentials-from-ransomware-compromise)‍\ ‍ ### 4. Restore Systems From a Back-Up Given the rapid development of ransomware and many different types, there is no single way to remove it from your systems. If you have an [external backup available](https://www.upguard.com/blog/how-to-back-up-your-data), you should completely wipe your systems to restore the original files. Ensure the backup is from a date prior to the ransomware attack to prevent re-infection. Keep in mind that removing the ransomware doesn’t necessarily decrypt files or restore original files – this can only be done using a ransomware decryptor (if available for the variant of infection). It’s best not to rely solely on these tools and to instead [adopt ransomware prevention measures](https://www.upguard.com/blog/best-practices-to-prevent-ransomware-attacks), such as the 3-2-1 backup strategy and installing an anti-malware / anti-virus solution, to protect against future attacks.  [*Learn how to prevent ransomware attacks.*](https://www.upguard.com/blog/best-practices-to-prevent-ransomware-attacks) ## Top 10 Free Ransomware Decryption Tools  There are currently many free ransomware decryption tools available for some of the most common types of ransomware. Below are the top 10 free decryptor tools to help you recover files encrypted following a ransomware attack.  ## 1. Avast Ransomware Decryption Tools Avast currently offers 30 free ransomware decryption tools for Microsoft Windows operating systems. Some ransomware variants covered include: * AES\_NI * Alcatraz Locker * Babuk * CrySiS * CryptoMix (Offline) * GandCrab * Globe * Jigsaw * Troldesh / Shade [*View the full list of Avast’s ransomware decryption tools*](https://www.avast.com/en-au/ransomware-decryption-tools)*.* ## 2. AVG  AVG currently offers 7 free ransomware decryption tools, for the following variants: * Apocalypse * BadBlock * Bart * Crypt888 * Legion * SZFLocker * TeslaCrypt [*View the full list of AVG’s decryption tools. *](https://www.avg.com/en-au/ransomware-decryption-tools) ## 3. Emsisoft Emsisoft currently offers 84 free ransomware decryption tools, such as: * Babuk * Cerber * CryptXXX * Globe * Jigsaw * REvil / Sodinokibi * Trojan.Encoder.6491 * RSA-NI * Unknown XTBL * WannaCry * Xorist [*View the full list of Emisoft’s decryption tools.*](https://www.emsisoft.com/ransomware-decryption-tools/free-download) ## 4. Kaspersky Kaspersky currently offers 6 free ransomware decryption tools, for the following variants: * Shade Decryptor * Rakhni Decryptor * Rannoh Decryptor * CoinVault Decryptor * Wildfire Decryptor * Xorist Decryptor [*View the full list of Kaspersky’s decryption tools. *](https://noransom.kaspersky.com/)‍ ## 5. McAfee McAfee’s Ransomware Recover (Mr2) is a framework designed to alleviate the time and resources required to develop a decryption framework from members of the [cybersecurity](https://www.upguard.com/blog/cyber-security) community who have decryption keys and decryption logic. [*Learn more about McAfee’s Ransomware Recover (Mr2).*](https://www.mcafee.com/enterprise/en-au/downloads/free-tools/how-to-use-ransomware-decryption.html) ## 6. No More Ransom Project The No More Ransom Project is a joint initiative by the National High Tech Crime Unit of the Netherlands’ police, Europol’s European Cybercrime Centre, Kaspersky and McAfee. The project aims to help victims of ransomware retrieve their encrypted data and avoid paying ransom to cybercriminals. [*Learn more about the No More Ransom Project.*](https://www.nomoreransom.org/en/about-the-project.html) ## 7. Quick Heal Quick Heal currently offers 20 free ransomware decryption tools, such as: * Troldesh * Crysis * Cryptxxx  * Ninja  * Apocalypse * STOP Djvu  [*View the full list of Quick Heal’s decryption tools.*](https://www.quickheal.com/free-ransomware-decryption-tool/) ## 8. Trend Micro Trend Micro currently offers 27 free ransomware decryption tools, such as: * Globe / Purge *  Xorist * CryptXXX v1,v2,v3,v4,v5 * Jigsaw * Globe/Purge * Crysis * WannaCry  [*View the full list of Trend Mirco’s decryption tools.*](https://success.trendmicro.com/dcx/s/solution/1114221-downloading-and-using-the-trend-micro-ransomware-file-?language=en_US) ## 9. WannaDecrypt WannaDecrypt is a free ransomware decryption tool for 5 ransomware variants, including: * WannaCrypt * WannaCry * WanaCrypt0r * WCrypt * WCRY [*Learn more about WannaDecrypt.*](https://github.com/netwrkspider/wannaDecrypt) ## 10. Wannakiwi Based off WannaDecrypt, Wanakiwi is a free ransomware decryption tool for systems affected by WannaCry ransomware. [*Learn more about Wanakiwi.*](https://github.com/gentilkiwi/wanakiwi) ## Final Thoughts Ransomware decryption tools should only be used in the final stages of a comprehensive ransomware defense strategy if all other security controls fail.  To learn how to implement a series of security controls to reduce the impact of ransomware attacks and potentially avoid the need for decryption tools, [read this post](https://www.upguard.com/blog/protecting-employee-credentials-from-ransomware-compromise). eBook The Ultimate Ransomware Defense Guide Free resource ### The Ultimate Ransomware Defense Guide [Download now](/resources/the-ultimate-ransomware-defense-guide) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)