unwrapKey method

This method is used to construct a Key object from encrypted key material.

Important  As of Microsoft Edge, this method returns a Promise object. See Web Cryptography API updates for more info.



var retVal = SubtleCrypto.unwrapKey(wrappedKey, keyAlgorithm, keyEncryptionKey, extractable, keyUsages);


wrappedKey [in]

Type: ArrayBufferView

The encrypted key material.

keyAlgorithm [in]

Type: any

An object identifying the cryptographic algorithm that the new key is intended to be used with (along with any required algorithmic parameters).

keyEncryptionKey [in]

Type: Key

A key that can be used to decrypt the key material in wrappedKey.

extractable [in, optional]

Type: bool

Whether or not keying material may be exported from the new Key object. The default value is false.

keyUsages [in, optional]

Type: sequence<DOMString>

An array containing one or more of the following DOM strings: encrypt, decrypt, sign, verify, derive, wrap, unwarp. These are the operations that the key generated by this operation will be permitted to perform.

Return value

Type: Promise

A Promise object that will return the Key object constructed from the encrypted key material.

Note  IE11 returns a KeyOperation. See Web Cryptography API updates for more info.


The caller supplies the wrappedKey object, which contains the encrypted key material, as well as a Key object that can be used to decrypt this key material. The caller can optionally specify the algorithm to be used with the returned Key object.

Be aware that the Boolean value associated with the extractable parameter can be stored in the wrappedKey object. In order for the key to be extractable, the extractable parameter and the analogous value within the wrappedKey object must both be true.

The wrappedKey object must contain a JSON Web Key (JWK) structure encapsulated with JSON Web Encryption (JWE). The content encryption algorithm used in the JWE must be AES-GCM. The keyWrappingKey parameter must be one of the types supported by wrapKey. The key represented by the JWK must be one of the types supported by generateKey.

See also