curl -X POST https://api.pocketutils.com/v1/xbel-decrypt \
-H "Authorization: Bearer YOUR_API_KEY" \
-F "file=@bookmarks.xbel" \
-F "key=my-backup-password"
const form = new FormData();
form.append("file", fileInput.files[0]);
form.append("key", "my-backup-password");
const res = await fetch("https://api.pocketutils.com/v1/xbel-decrypt", {
method: "POST",
headers: { Authorization: "Bearer YOUR_API_KEY" },
body: form,
});
const { downloadUrl } = await res.json();
import requests
with open("bookmarks.xbel", "rb") as f:
res = requests.post(
"https://api.pocketutils.com/v1/xbel-decrypt",
headers={"Authorization": "Bearer YOUR_API_KEY"},
files={"file": f},
data={"key": "my-backup-password"},
)
download_url = res.json()["downloadUrl"]
{
"success": true,
"downloadUrl": "https://api.pocketutils.com/v1/xbel-decrypt/download/bookmarks-1784541598485-566752584-decrypted.xbel",
"fileName": "bookmarks-decrypted.xbel",
"message": "File decrypted successfully"
}
Bookmark Files
XBEL Decryptor
Decrypt an AES-GCM encrypted XBEL bookmark archive back to plain XML.
POST
/
v1
/
xbel-decrypt
curl -X POST https://api.pocketutils.com/v1/xbel-decrypt \
-H "Authorization: Bearer YOUR_API_KEY" \
-F "file=@bookmarks.xbel" \
-F "key=my-backup-password"
const form = new FormData();
form.append("file", fileInput.files[0]);
form.append("key", "my-backup-password");
const res = await fetch("https://api.pocketutils.com/v1/xbel-decrypt", {
method: "POST",
headers: { Authorization: "Bearer YOUR_API_KEY" },
body: form,
});
const { downloadUrl } = await res.json();
import requests
with open("bookmarks.xbel", "rb") as f:
res = requests.post(
"https://api.pocketutils.com/v1/xbel-decrypt",
headers={"Authorization": "Bearer YOUR_API_KEY"},
files={"file": f},
data={"key": "my-backup-password"},
)
download_url = res.json()["downloadUrl"]
{
"success": true,
"downloadUrl": "https://api.pocketutils.com/v1/xbel-decrypt/download/bookmarks-1784541598485-566752584-decrypted.xbel",
"fileName": "bookmarks-decrypted.xbel",
"message": "File decrypted successfully"
}
Decrypts an encrypted XBEL bookmark export (as produced by tools like Floccus) back into plain XBEL XML using AES-GCM with a PBKDF2-derived key (250,000 iterations, SHA-256). If the uploaded file turns out to already be plain XML, it’s passed through unchanged — you don’t need to know in advance whether a file needs decrypting.
See the full error reference for the platform-level codes (
1 credit per call
Request
multipart/form-data, not JSON.
The
.xbel file to decrypt. Max 10 MB. Must have a .xbel extension (or be sent as application/octet-stream, since browsers rarely know the XBEL MIME type).The decryption password. Always required by the request, even if the file turns out to be unencrypted.
Response
Absolute URL to fetch the decrypted file from —
GET it directly, no auth required. Valid for 30 minutes.Suggested filename for the download, derived from your upload (e.g.
bookmarks.xbel → bookmarks-decrypted.xbel).Download the result
GET the downloadUrl from the response directly — it streams the file with a Content-Disposition: attachment header. No credit cost, no auth required. After 30 minutes the file is deleted and the link 404s.
Errors
| Status | Cause |
|---|---|
400 | No file attached to the request |
400 | key missing from the form fields |
500 | Wrong password, or the file isn’t valid XBEL / the expected { ciphertext, salt } JSON shape |
404 | (on the download endpoint) the file’s 30-minute window has expired |
401, 402, 429) that apply to every endpoint.
curl -X POST https://api.pocketutils.com/v1/xbel-decrypt \
-H "Authorization: Bearer YOUR_API_KEY" \
-F "file=@bookmarks.xbel" \
-F "key=my-backup-password"
const form = new FormData();
form.append("file", fileInput.files[0]);
form.append("key", "my-backup-password");
const res = await fetch("https://api.pocketutils.com/v1/xbel-decrypt", {
method: "POST",
headers: { Authorization: "Bearer YOUR_API_KEY" },
body: form,
});
const { downloadUrl } = await res.json();
import requests
with open("bookmarks.xbel", "rb") as f:
res = requests.post(
"https://api.pocketutils.com/v1/xbel-decrypt",
headers={"Authorization": "Bearer YOUR_API_KEY"},
files={"file": f},
data={"key": "my-backup-password"},
)
download_url = res.json()["downloadUrl"]
{
"success": true,
"downloadUrl": "https://api.pocketutils.com/v1/xbel-decrypt/download/bookmarks-1784541598485-566752584-decrypted.xbel",
"fileName": "bookmarks-decrypted.xbel",
"message": "File decrypted successfully"
}
Was this page helpful?