Before you consider paying, check whether a free decryptor exists for your ransomware family. No More Ransom hosts a repository of keys and tools, and CISA advises consulting federal law enforcement about possible decryptors. Not every variant has one, so this is a check, not a plan.
What No More Ransom offers
The project says it has created a repository of keys and applications that can decrypt data locked by different types of ransomware. Its homepage showed a list of families with decryption tools at the time of review, and states plainly that not every type of ransomware has a solution. It also links to a tool called Crypto Sheriff, a Q&A, prevention advice and a page to report a crime. The footer carries Europol and Dutch police logos.
What CISA adds
CISA's response checklist says to consult federal law enforcement about possible decryptors even if mitigation seems possible, because researchers sometimes publish tools for specific variants. That is a free step worth taking early.
Step by step
- Preserve first. Keep a copy of the ransom note and a few encrypted sample files. Do not overwrite or delete encrypted files while you investigate.
- Identify the family. The note text, file extension and contact details usually point to a family. Ask your incident response provider or law enforcement to confirm rather than guessing.
- Check the project. Look for your family on No More Ransom and read its instructions carefully.
- Ask law enforcement. Report the incident and ask whether a decryptor is available.
- Use official tools only. Download decryption tools from the project or agency sites. A fake decryptor is a convenient way to infect victims again.
- Test on copies. Run a decryptor against copies of encrypted files, never the only copy.
Limits
A decryptor recovers files. It does not remove the attacker's access, and it will not help with data that was copied and threatened with release. You still need containment, a rebuild plan and credential resets.
Common mistakes
- Searching for a decryptor on random sites and running whatever is offered.
- Wiping encrypted systems before copying samples, which removes the evidence a researcher or investigator needs.
- Assuming a decryptor for the wrong family will work. Similar looking notes can come from different groups.
- Treating the decryptor as the end of the incident. Access and stolen data still need handling.
Quick check
Will a decryptor exist for our variant?
Maybe. No More Ransom says not every type has a solution. Check, but keep your backup plan.
Should we decrypt files in place?
No. Work on copies so a failed or faulty tool does not destroy the only version of the data.
Sources
Last reviewed: 19 October 2026.
