code: func Decrypt(payload []byte, secret string) ([]byte, error) {
  	salt := payload[:saltLength]
  	key := encryptionKeyToBytes(secret, string(salt))
  
  	block, err := aes.NewCipher(key)
  	if err != nil {
  		return nil, err
  	}
  
  	// The IV needs to be unique, but not secure. Therefore it's common to
  	// include it at the beginning of the ciphertext.
  	if len(payload) < aes.BlockSize {
  		return nil, errors.New("payload too short")
  	}
  	iv := payload[saltLength : saltLength+aes.BlockSize]
  	payload = payload[saltLength+aes.BlockSize:]
  	payloadDst := make([]byte, len(payload))
  
  	stream := cipher.NewCFBDecrypter(block, iv)
  
  	// XORKeyStream can work in-place if the two arguments are the same.
  	stream.XORKeyStream(payloadDst, payload)
  	return payloadDst, nil
  }
docs: // Decrypt decrypts a payload with a given secret.