move decrypt out