> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pocketutils.com/llms.txt
> Use this file to discover all available pages before exploring further.

# XBEL Decryptor

> Decrypt an AES-GCM encrypted XBEL bookmark archive back to plain XML.

Decrypts an encrypted XBEL bookmark export (as produced by tools like Floccus) back into plain XBEL XML using AES-GCM with a PBKDF2-derived key (250,000 iterations, SHA-256). If the uploaded file turns out to already be plain XML, it's passed through unchanged — you don't need to know in advance whether a file needs decrypting.

<Info>
  **1 credit** per call · Typical response time \~90ms
</Info>

## Request

`multipart/form-data`, not JSON.

<ParamField body="file" type="file" required>
  The `.xbel` file to decrypt. Max **10 MB**. Must have a `.xbel` extension (or be sent as `application/octet-stream`, since browsers rarely know the XBEL MIME type).
</ParamField>

<ParamField body="key" type="string" required>
  The decryption password. Always required by the request, even if the file turns out to be unencrypted.
</ParamField>

## Response

<ResponseField name="success" type="boolean" required />

<ResponseField name="downloadUrl" type="string" required>
  Absolute URL to fetch the decrypted file from — `GET` it directly, no auth required. Valid for **30 minutes**.
</ResponseField>

<ResponseField name="fileName" type="string" required>
  Suggested filename for the download, derived from your upload (e.g. `bookmarks.xbel` → `bookmarks-decrypted.xbel`).
</ResponseField>

<ResponseField name="message" type="string" required />

## Download the result

`GET` the `downloadUrl` from the response directly — it streams the file with a `Content-Disposition: attachment` header. No credit cost, no auth required. After 30 minutes the file is deleted and the link 404s.

## Errors

| Status | Cause                                                                                         |
| ------ | --------------------------------------------------------------------------------------------- |
| `400`  | No file attached to the request                                                               |
| `400`  | `key` missing from the form fields                                                            |
| `500`  | Wrong password, or the file isn't valid XBEL / the expected `{ ciphertext, salt }` JSON shape |
| `404`  | (on the download endpoint) the file's 30-minute window has expired                            |

See the full [error reference](/errors) for the platform-level codes (`401`, `402`, `429`) that apply to every endpoint.

<RequestExample>
  ```bash cURL theme={null}
  curl -X POST https://api.pocketutils.com/v1/xbel-decrypt \
    -H "Authorization: Bearer YOUR_API_KEY" \
    -F "file=@bookmarks.xbel" \
    -F "key=my-backup-password"
  ```

  ```javascript JavaScript theme={null}
  const form = new FormData();
  form.append("file", fileInput.files[0]);
  form.append("key", "my-backup-password");

  const res = await fetch("https://api.pocketutils.com/v1/xbel-decrypt", {
    method: "POST",
    headers: { Authorization: "Bearer YOUR_API_KEY" },
    body: form,
  });
  const { downloadUrl } = await res.json();
  ```

  ```python Python theme={null}
  import requests

  with open("bookmarks.xbel", "rb") as f:
      res = requests.post(
          "https://api.pocketutils.com/v1/xbel-decrypt",
          headers={"Authorization": "Bearer YOUR_API_KEY"},
          files={"file": f},
          data={"key": "my-backup-password"},
      )
  download_url = res.json()["downloadUrl"]
  ```
</RequestExample>

<ResponseExample>
  ```json Response theme={null}
  {
    "success": true,
    "downloadUrl": "https://api.pocketutils.com/v1/xbel-decrypt/download/bookmarks-1784541598485-566752584-decrypted.xbel",
    "fileName": "bookmarks-decrypted.xbel",
    "message": "File decrypted successfully"
  }
  ```
</ResponseExample>


## Related topics

- [Introduction](/index.md)
- [XBEL to HTML](/api-reference/xbel-to-html.md)
- [Rate Limits & Credits](/rate-limits-and-credits.md)