The advanced utilities workflow component, AES encrypt/decrypt can be used for encrypting and decrypting data in the payload. This can e.g. be used in relation to KSeF 2.0 (mandatory e-invoicing Poland since Feb/Apr 2026).

The component has these parameters:

Possible values are: encrypt and decrypt. This determines if the payload should be encrypted or decrypted. The result of the encryption/decryption is saved to the payload.

Possible values are: AES-CBC (PKCS#7), AES-GCM (authenticated) and AES-CTR. This selects the encryption mode that should be used for the encrypt/decrypt. For the decrypt you need to select the same value as the one used when the data was encrypted.

This parameter is optional for encryption and mandatory for decryption. If used the value must be base64 encoded.

If you do not enter a value when encrypting, then InterformNG2 will create a random key itself. That value will be copied to the variable referenced in the field below: Output variable: Key (base64).

When you are decrypting, then you need to set the same value as was used for the encryption. This can e.g. be done via an XPath expression.

IV / nonce (Base64) 

This parameter (like the Key above) is optional for encryption and mandatory for decryption. This parameter is also called "Initialization Vector" / "Number used once".  If used the value must be base64 encoded. It is combined with the Key parameter above. It's typically sent alongside the ciphertext, unencrypted — but it must vary between encryptions using the same key. 

If you do not enter a value when encrypting, then InterformNG2 will create a random value itself. That value will be copied to the variable referenced in the field below: Output variable: IV /nonce (base64). When you are decrypting, then you need to set the same value as was used for the encryption. This can e.g. be done via an XPath expression.

This is the key size in bits used for the encryption. Possible values are: 128, 192 and 256. The default value is 256, which will be used if this is not selected. The same key size must be used for both encryption and decryption. Generally the higher value takes a bit more processing, but are also more secure.

This parameter is only used for encryption in the scenario, where the Key parameter above is not used. Here you should state the name of the variable, which should receive the Key value generated while encrypting the payload.

This parameter is only used for encryption in the scenario, where the IV / nonce parameter above is not used. Here you should state the name of the variable, which should receive the IV / nonce value generated while encrypting the payload.

This parameter is only relevant if you have selected AES-GCM (authenticated) for the cipher mode parameter above. Here you can add another level of security by adding this. You need to use the exact same value for this parameter both when you encrypt and decrypt. 

If the decrypt fails then workflow will fail with an error like below: