PKCS#7 Padding

PKCS#7 padding appends n bytes of value n (1 ≤ n ≤ block_size) to the end of the plaintext; reversible and self-verifying, it is the de facto standard padding for CBC mode.

Purpose

It provides reversible and verifiable padding so the decryptor can determine the true plaintext length and detect padding errors.

Mechanism

If the plaintext length is already a multiple of the block size, a full block of padding (each byte of value block_size) is still appended to preserve reversibility. On decryption, the last byte’s value n is read and the final n bytes are removed after checking they all equal n. A failed check indicates a corrupted or tampered ciphertext.

Use cases

Default AES-CBC padding
CMS/PKCS#7 message formats
Java PKCS5Padding (equivalent to PKCS7)
OpenSSL default padding

Examples

Input
```
block=16, data=13 bytes
```
Output
```
appends 03 03 03
```
Pads with three 0x03 bytes

Common errors

Non-constant-time padding verification falls to Padding Oracle attacks: Use AEAD, or compare padding in constant time

Related terms

Padding is the mechanism that extends the plaintext to a block boundary; common schemes include PKCS#7, zero padding, and ISO 10126, while AEAD modes need none.

CBC (Cipher Block Chaining)

CBC mode XORs the previous ciphertext block with the current plaintext before encrypting, so identical plaintext blocks yield different ciphertexts; it requires a random IV but provides no integrity authentication.

A block cipher is a symmetric cipher that encrypts and decrypts fixed-length blocks (e.g., 128 bits) and requires a mode of operation to handle arbitrary-length data.

Related tools

Encrypt text or binary data with AES (CBC/GCM/ECB) using Web Crypto API. Free, private, and 100% client-side.

References