> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# File decryption methods

> Lists supported file decryption methods with procedural steps and code examples.

We support the following methods for decrypting files:

* File Encryption Agent GUI
* Futurex Command Line Interface (FXCLI)

<Note>
  In addition to having the required File Encryption permissions, you must grant identities the Use permission on the File Encryption Profile that performs decryption operations.
</Note>

<Note>
  If you configured the File Encryption Profile for decryption with a File Encryption v1 key, you must authenticate with a hardened identity with Use permissions on the key. You can use the default Admin1 and Admin2 identities.
</Note>

Select one of the following methods and perform the instructions:

## **File Encryption Agent GUI**

To decrypt files by using the File Encryption Agent GUI, perform the following steps.

<Steps>
  <Step>
    Locate and run `fenca-gui.exe`, which is contained in the main **fenca** directory. The installation process defines this location.
  </Step>

  <Step>
    In the **Futurex File Encryption** GUI, select **\[ Open File ]** at the bottom of the window.
  </Step>

  <Step>
    In the **File** **Details** window, select **\[ Browse ]** to locate and select the file to decrypt.
  </Step>

  <Step>
    After all the fields are pulled automatically from the file header, verify the check digits of the File Encryption Key used to decrypt the file and select **\[ Decrypt ]**. Then, choose a location to save the decrypted file and select **\[ Save ]**.
  </Step>

  <Step>
    When a message confirms that the file has been successfully decrypted, select **\[ OK ]**.
  </Step>
</Steps>

## Futurex **Command Line Interface (FXCLI)**

To decrypt files using the **FXCLI**, perform the following steps:

<Steps>
  <Step>
    Locate and run `fxcli-kmes.exe`, which is inside the `bin` directory in the main `fxcl` directory. This location is defined during the installation process.
  </Step>

  <Step>
    In FXCLI, run the following **tls** commands to configure the same TLS certificates configured in the File Encryption GUI:

    ```shell title="FXCLI" expandable lines wrap theme={null}
      $ tls pki --file C:\FENCA\TLS\file_encryption_agent.p12 --password file_password

      $ tls ca --file C:\FENCA\TLS\root_ca_cert.pem
    ```
  </Step>

  <Step>
    Connect to the KMES Series 3.

    ```shell title="FXCLI" expandable lines wrap theme={null}
      $ connect --connect 10.0.5.40:2001
    ```
  </Step>

  <Step>
    Log in to the KMES Series 3 with the same identity used for the File Encryption Agent in the previous section.

    ```shell title="FXCLI" expandable lines wrap theme={null}
      $ login user --username FileEncryptionAgent --password identity_password
    ```

    <Warning>
      You must configure the Password authentication mechanism for the FileEncryptionAgent identity to log in with a password by using the preceding command.
    </Warning>
  </Step>

  <Step>
    List the **name** and **uuid** of all File Encryption Profiles that the FileEncryptionAgent identity can access.

    ```shell title="FXCLI" expandable lines wrap theme={null}
      $ file-protect list
      Found 1 file encryption profiles.
      result:
          status: success
          statusCode: 0
      profiles:
          -
              name: "File Encryption Agent"
              uuid: "{0157AD66-9C66-0001-001A-35FA039C55EE}"
    ```
  </Step>

  <Step>
    Decrypt an encrypted file.

    ```shell title="FXCLI" expandable lines wrap theme={null}
      $ file-protect decrypt --file C:\FENCA\test.enc --out C:\FENCA\test.txt --local --profile "{0157AD66-9C66-0001-001A-35FA039C55EE}"
    ```

    <Note>
      The --local flag is optional for File Encryption v1 keys but required for File Encryption v2 keys.

      The --local flag makes FXCLI pull keys and encrypt locally instead of sending the file to the KMES to be encrypted.
    </Note>

    <Note>
      FXCLI determines which File Encryption Profile to use for decryption by referencing the uuid you provide in the --profile flag.
    </Note>
  </Step>
</Steps>