WhatsApp Crypt Tool to Encrypt and Decrypt WhatsApp Backups
The wa-crypt-tools suite, available on GitHub, provides an open-source solution for managing encrypted WhatsApp backups. This tool can decrypt and encrypt .crypt12, .crypt14, and .crypt15 files from WhatsApp and WhatsApp Business when users provide the…
The wa-crypt-tools suite, available on GitHub, provides an open-source solution for managing encrypted WhatsApp backups. This tool can decrypt and encrypt .crypt12, .crypt14, and .crypt15 files from WhatsApp and WhatsApp Business when users provide the necessary key file or a 64-character key.
wa-crypt-tools facilitates access to WhatsApp’s end-to-end encrypted backups, which store chat histories, media, and metadata in SQLite databases or ZIP archives. Developed by ElDavoo, it integrates protobuf handling for modern formats and is compatible with forensic suites like whapa for in-depth analysis.
Users can deploy the tool through various methods without requiring complex local setup. Google Colab offers a browser-based notebook for quick tests, making it accessible for non-technical users or cloud-based workflows. Locally, the tool can be installed via pip using the command python -m pip install wa-crypt-tools for stable builds or from the GitHub URL for development versions. Jupyter notebooks are suitable for data scientists familiar with the environment.
Decryption can be performed using the wadecrypt command: wadecrypt encrypted_backup.key msgstore.db.crypt15 msgstore.db , which produces a readable SQLite file after loading the Crypt15 key.
The wa-crypt-tools suite, available on GitHub, provides an open-source solution for managing encrypted WhatsApp backups.
Encryption with waencrypt is currently in beta, requiring a reference crypt15 file for reliability, as demonstrated by the command waencrypt --reference msgstore.db.crypt15 key msgstore.db new.crypt15 . Additional utilities include wainfo for inspecting backups, wacreatekey for generating keys, and waguess for attempting brute-force guesses.
Cybersecurity professionals utilize this tool for mobile forensics to extract evidence from rooted Android devices at /data/data/com.whatsapp/files/key. It supports decryption of .mcrypt1 Google Drive files, although this feature is undocumented.
No decryption is possible without the key passwords, which are necessary for retrieving keys from WhatsApp servers. Compatibility issues with newer app versions (last tested on 2.24.x) exist, and challenges such as crypt15 failures may require force flags or developer support via Telegram.
Experts recommend using end-to-end encrypted (E2EE) backups without passwords and managing keys via wacreatekey, ensuring their secure storage to prevent WhatsApp rotations.
This tool supports ethical forensics without the need to root devices and highlights WhatsApp’s robust encryption when keys remain secure.
Based on reporting by Cyber Security News.
