Various ransomware affected file
File type: Ransomware encrypted file
Files with encrypted suffix can be commonly encountered as files that have been encrypted and renamed with one of the many known ransomware types.
Found 3 different file type records with the same encrypted filename suffix.
File type category:
Ransomware encrypted file
Date updated: February 27, 2017
File extension encrypted is commonly used by various ransomware as a replacement for the original suffix after the files have been encrypted.
Literally, dozen different ransomware types use this extension, so if you find one of these on your drive, you have to determine the exact type based on the ransomware note that is usually found in affected folders.
Ransomware which use encrypted extension include:
Some of .encrypted files can be decrypted, but many of them cannot be. Your best option is to look for a decryptor a particular type of ransomware which you can identify based on the ransomware note.
The original files can only be converted once they have been successfully recovered.
Software apps that recover encrypted files:
Microsoft Windows
File type category:
Ransomware encrypted file
Date updated: October 5, 2026
The .encrypted file extension was used by ransomware featuring Donald Trump that appeared in late September 2016. It was added when the ransomware renamed affected files.
Reports indicated that the encryption mechanism in the released ransomware did not work. This could change in a later version, so the presence of the suffix alone does not confirm that the file contents were encrypted.
A normal application cannot open this file as a document. If the Donald Trump ransomware encrypted the file, a decrypter specifically intended for that ransomware would be needed to recover its contents.
This file cannot be meaningfully converted while it remains affected by the ransomware. It must first be recovered or decrypted; the recovered file can then be opened or converted according to its original format.
File type category:
Ransomware encrypted file
Date updated: October 16, 2026
KeRanger is ransomware for Apple's OS X operating system. It encrypts users' files and demands a ransom payment in bitcoins. The ransomware was distributed through an infected version of the Transmission BitTorrent client.
KeRanger targeted many types of files, including documents such as DOC, DOCX, DOCM, DOT, DOTM, PPT, PPTX, PPTM, POT, POTX, POTM, PPS, PPSM, PPSX, XLS, XLSX, XLSM, XLT, XLTM, XLTX, TXT, CSV, RTF and TEX files; JPG and JPEG images; MP3, MP4, AVI, MPG, WAV and FLAC audio or video files; ZIP, RAR, TAR and GZIP archives; source-code files such as CPP, ASP, CSH, CLASS, JAVA and LUA; DB and SQL databases; EML email files; and PEM certificate files. It also targeted more than 300 other file types.
The .encrypted file is the encrypted version of the original file, not a separate document format. KeRanger is no longer an active, current OS X application or file format.
There is no ordinary OS X application that can open a KeRanger .encrypted file. The file must be decrypted with a KeRanger-compatible decryption tool, if one is available.
Do not rename the file or treat it as a normal document. Recovery may be possible from an unaffected backup; paying the ransom does not guarantee recovery.
A KeRanger .encrypted file cannot be converted to another format while it remains encrypted. Recovery requires a compatible decryption utility or an unaffected backup of the original file.
Language