class SecretManager {

    public String decrypt(final String str) {
        // Handle null or empty string decryption more gracefully
        if (str == null || str.isEmpty()) {
            return str;
        }

        try {
            final byte[] ciphertext = DatatypeConverter.parseBase64Binary(str);
            if (ciphertext.length < 48) {
                return null;
            }
            final byte[] salt = Arrays.copyOfRange(ciphertext, 0, 16);
            final byte[] iv = Arrays.copyOfRange(ciphertext, 16, 32);
            final byte[] ct = Arrays.copyOfRange(ciphertext, 32, ciphertext.length);

            final SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
            final KeySpec spec = new PBEKeySpec(passphrase.toCharArray(), salt, 65536, 128);
            final SecretKey tmp = factory.generateSecret(spec);
            final SecretKey secret = new SecretKeySpec(tmp.getEncoded(), "AES");
            final Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");

            cipher.init(Cipher.DECRYPT_MODE, secret, new IvParameterSpec(iv));
            final byte[] plaintext = cipher.doFinal(ct);

            return new String(plaintext, StandardCharsets.UTF_8);
        } catch (final Exception exception) {
            throw new RuntimeException(exception.getMessage(), exception);
        }
    }

    public  SecretManager(final String passphrase);

}