Ransom-Note Interpreter
A ransom note lands on a locked machine and the clock is already running. Paste its text here and this tool reads it for you — entirely in your browser — surfacing heuristic signals of a possible ransomware family (always a lead to verify independently, never a confirmed ID), what the note demands and threatens (payment, cryptocurrency, a deadline, a data-leak threat, the contact channel), the typical TTPs associated with that family, a pointer to free decryptor resources (No More Ransom) without pretending one exists, and the immediate-response checklist. It is strictly defensive — it will not generate a note, facilitate payment, or decrypt anything — and nothing you paste is uploaded or stored.
What you'll get
- Heuristic signals pointing at a possible ransomware family — with the exact markers that matched, and a standing "verify independently" caveat.
- A breakdown of what the note demands: payment, cryptocurrency, a deadline/countdown, a data-leak (double-extortion) threat, and the contact channel.
- Typical TTPs associated with the signalled family, framed for defenders.
- A pointer to free decryptor resources (No More Ransom) — without ever claiming one exists for your note.
- The immediate-response checklist: isolate, preserve evidence, keep the note, engage IR + legal + insurer, and report to authorities.
Paste a note above, or load the clearly-synthetic example to see how it works.
What this tool is
- A free, 100% in-browser tool for defenders: paste a ransomware ransom note and get a response-oriented analysis. Nothing is uploaded, there are no server calls, and nothing you paste is stored.
- It reads the note for heuristic signals of a possible ransomware family (file-extension, note-filename, branding, contact-channel and wording markers), and shows exactly which markers matched. Every family guess is a "possible match — verify independently", never a confirmed identification.
- It extracts what the note demands and threatens: payment, cryptocurrency, a deadline/countdown, a data-leak (double-extortion) threat, and the contact channel (.onion portal, Tox/qTox, Session, email).
- It lists typical TTPs associated with the signalled family for defender context, and points you to free decryptor resources (No More Ransom, nomoreransom.org) without ever claiming a decryptor exists for your note.
- It is strictly defensive: it does not generate notes, facilitate payment, or decrypt anything. It finishes with the immediate-response checklist — isolate, preserve evidence, keep the note, engage IR + legal + insurer, and report to authorities.
Attribution is a lead, not an answer
The single most important thing this tool does is refuse to overclaim. A ransom note is one of the weakest pieces of evidence for naming a group: templates are copied between crews, affiliates of a ransomware-as-a-service operation reuse the same branding across unrelated intrusions, file extensions and note filenames are recycled or deliberately spoofed, and imitators borrow a famous name to frighten victims. So every family signal here is presented as a possible match with a low or possible confidence, with the exact markers that fired shown so you can judge them yourself — and a standing instruction to confirm against No More Ransom, CISA advisories and vendor IOC reporting before you act on any name. Where a group is defunct or rebranded — Hive was disrupted by the FBI in 2023, Royal largely became BlackSuit — the tool flags that too, because a note bearing an old name should make you more skeptical, not less.
Everything else is in service of a calm, correct first hour. The demand analysis makes the coercion explicit — a countdown and a doubling price are pressure tactics, and a leak threat means you should assume data was stolen and open a breach-notification workstream in parallel. The indicators the tool extracts (a .onion portal, a Tox or Session ID, wallet-like strings, contact emails) exist to be preserved and handed to responders, never acted on. And the checklist keeps the irreversible mistakes off the table: isolate without powering off, do not delete the note, engage incident response, legal and your insurer before contacting anyone or paying, and check for a free decryptor before money ever enters the conversation. This tool is not legal advice and does not decide whether to pay — it makes sure you do not foreclose your good options in the first ten minutes.
Frequently asked questions
What does the Ransom-Note Interpreter do?
You paste the text of a ransomware ransom note and the tool parses it, entirely in your browser, to help you respond. It flags heuristic signals of a possible ransomware family (and shows the exact markers that matched), summarises what the note demands and threatens, lists typical tradecraft associated with the signalled family for context, points you to free decryptor resources, and walks you through the immediate-response checklist. It is a response aid for defenders — it never helps an attacker, and it stores nothing.
Can it definitively identify the ransomware family?
No, and it deliberately never claims to. Ransomware attribution is genuinely hard: notes are copied between groups, affiliates reuse templates, extensions and filenames are reused or spoofed, and imitators exist. The tool matches a small dataset of well-documented, public markers for well-known families and reports a confidence of only "low" or "possible" — every family result is labelled a possible match that you must verify independently against sources like No More Ransom, CISA advisories, and vendor IOC reports. Treat it as a lead, not an answer.
Which families does it know about?
A modest, deliberately accurate set of well-known families: LockBit, BlackCat/ALPHV, Cl0p, Akira, Play, Black Basta, Royal (now largely rebranded BlackSuit), Hive (law-enforcement disrupted in 2023), Phobos/Dharma, and STOP/Djvu. The markers are limited to documented public indicators — file-extension patterns, note-filename patterns, branding strings, contact-channel formats and characteristic wording. If none match, that does not mean the note is not ransomware; many families, variants and imitators are simply outside this dataset, and the tool says so.
Does it tell me a decryptor exists?
No. It points you to the No More Ransom project (nomoreransom.org) and its Crypto Sheriff as the place to check whether a free decryptor is currently available for your variant, and it notes that a "no match" there is inconclusive rather than hopeless. It never asserts that a working decryptor exists for your specific note — that depends on the exact family and variant and must be confirmed independently. One family note is relevant here: some STOP/Djvu variants encrypted with "offline keys" are decryptable with Emsisoft's free tool, which is why verifying attribution matters before paying.
Is this safe to use, and does anything leave my browser?
Yes, and no. The entire analysis runs client-side in JavaScript against an in-code dataset — there are no network or API calls, no account, and nothing you paste is uploaded, logged or stored. The "Copy analysis" and "Download .md" buttons work locally. The tool is strictly defensive: it will not generate a ransom note, help facilitate a payment, or decrypt files, and the extracted indicators (wallet-like strings, .onion addresses, contact channels) are surfaced only so you can preserve them for responders and law enforcement — not to act on.
Should I pay the ransom?
This tool does not and cannot advise you to pay, and paying is never a step it facilitates. That decision involves recovery odds (payment never guarantees a working decryptor), the risk of funding further crime, and real legal and sanctions exposure that depends on the actor and your jurisdiction. Engage your incident-response team, legal counsel and cyber-insurer before making any decision, and report to the relevant authorities. This is not legal advice.