XBEL Decryptor

curl -X POST https://api.pocketutils.com/v1/xbel-decrypt \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "file=@bookmarks.xbel" \
  -F "key=my-backup-password"

const form = new FormData();
form.append("file", fileInput.files[0]);
form.append("key", "my-backup-password");

const res = await fetch("https://api.pocketutils.com/v1/xbel-decrypt", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY" },
  body: form,
});
const { downloadUrl } = await res.json();

import requests

with open("bookmarks.xbel", "rb") as f:
    res = requests.post(
        "https://api.pocketutils.com/v1/xbel-decrypt",
        headers={"Authorization": "Bearer YOUR_API_KEY"},
        files={"file": f},
        data={"key": "my-backup-password"},
    )
download_url = res.json()["downloadUrl"]

{
  "success": true,
  "downloadUrl": "https://api.pocketutils.com/v1/xbel-decrypt/download/bookmarks-1784541598485-566752584-decrypted.xbel",
  "fileName": "bookmarks-decrypted.xbel",
  "message": "File decrypted successfully"
}

POST

xbel-decrypt

curl -X POST https://api.pocketutils.com/v1/xbel-decrypt \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "file=@bookmarks.xbel" \
  -F "key=my-backup-password"

const form = new FormData();
form.append("file", fileInput.files[0]);
form.append("key", "my-backup-password");

const res = await fetch("https://api.pocketutils.com/v1/xbel-decrypt", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY" },
  body: form,
});
const { downloadUrl } = await res.json();

import requests

with open("bookmarks.xbel", "rb") as f:
    res = requests.post(
        "https://api.pocketutils.com/v1/xbel-decrypt",
        headers={"Authorization": "Bearer YOUR_API_KEY"},
        files={"file": f},
        data={"key": "my-backup-password"},
    )
download_url = res.json()["downloadUrl"]

{
  "success": true,
  "downloadUrl": "https://api.pocketutils.com/v1/xbel-decrypt/download/bookmarks-1784541598485-566752584-decrypted.xbel",
  "fileName": "bookmarks-decrypted.xbel",
  "message": "File decrypted successfully"
}

Decrypts an encrypted XBEL bookmark export (as produced by tools like Floccus) back into plain XBEL XML using AES-GCM with a PBKDF2-derived key (250,000 iterations, SHA-256). If the uploaded file turns out to already be plain XML, it’s passed through unchanged — you don’t need to know in advance whether a file needs decrypting.

1 credit per call

Request

multipart/form-data, not JSON.

file

required

The .xbel file to decrypt. Max 10 MB. Must have a .xbel extension (or be sent as application/octet-stream, since browsers rarely know the XBEL MIME type).

string

required

The decryption password. Always required by the request, even if the file turns out to be unencrypted.

Response

boolean

required

string

required

Absolute URL to fetch the decrypted file from — GET it directly, no auth required. Valid for 30 minutes.

string

required

Suggested filename for the download, derived from your upload (e.g. bookmarks.xbel → bookmarks-decrypted.xbel).

string

required

Download the result

GET the downloadUrl from the response directly — it streams the file with a Content-Disposition: attachment header. No credit cost, no auth required. After 30 minutes the file is deleted and the link 404s.

Errors

Status	Cause
`400`	No file attached to the request
`400`	`key` missing from the form fields
`500`	Wrong password, or the file isn’t valid XBEL / the expected `{ ciphertext, salt }` JSON shape
`404`	(on the download endpoint) the file’s 30-minute window has expired

See the full error reference for the platform-level codes (401, 402, 429) that apply to every endpoint.

curl -X POST https://api.pocketutils.com/v1/xbel-decrypt \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "file=@bookmarks.xbel" \
  -F "key=my-backup-password"

const form = new FormData();
form.append("file", fileInput.files[0]);
form.append("key", "my-backup-password");

const res = await fetch("https://api.pocketutils.com/v1/xbel-decrypt", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY" },
  body: form,
});
const { downloadUrl } = await res.json();

import requests

with open("bookmarks.xbel", "rb") as f:
    res = requests.post(
        "https://api.pocketutils.com/v1/xbel-decrypt",
        headers={"Authorization": "Bearer YOUR_API_KEY"},
        files={"file": f},
        data={"key": "my-backup-password"},
    )
download_url = res.json()["downloadUrl"]

{
  "success": true,
  "downloadUrl": "https://api.pocketutils.com/v1/xbel-decrypt/download/bookmarks-1784541598485-566752584-decrypted.xbel",
  "fileName": "bookmarks-decrypted.xbel",
  "message": "File decrypted successfully"
}

Getting Started

API Reference

Request

Response

Download the result

Errors

​Request

​Response

​Download the result

​Errors

Request

Response

Download the result

Errors