Encrypt and decrypt data

To encrypt data, send it to Infisical with an Encrypt/Decrypt key, and Infisical returns the ciphertext. To read the data again, send the ciphertext back with the same key. Infisical doesn’t store your data or the ciphertext.

Prerequisites

An Encrypt/Decrypt key
The Member role to follow the UI steps, or the Cryptographic Operator role to follow the API steps (see Who can use a key)

Encrypt data

Infisical UI
API

In your KMS project, go to Overview, select the options menu on the key’s row, then select Encrypt Data.

Enter your data in Data (Plaintext). If your data is already Base64 encoded, turn on Data is Base64 encoded.

Select Encrypt, then copy the ciphertext from Encrypted Data (Ciphertext).

Base64 encode your data, then call the encrypt endpoint with the key’s ID:

curl --request POST \
  --url https://app.infisical.com/api/v1/kms/keys/<key-id>/encrypt \
  --header 'Authorization: Bearer <access-token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "plaintext": "SGVsbG8sIFdvcmxkIQ=="
  }'

If you use EU Cloud or self-host Infisical, replace https://app.infisical.com with https://eu.infisical.com or the address of your instance.

The response contains the ciphertext:

{
  "ciphertext": "<base64-encoded-ciphertext>"
}

Decrypt data

Infisical UI
API

In your KMS project, go to Overview, select the options menu on the row of the key that encrypted the data, then select Decrypt Data.

Paste the ciphertext into Encrypted Data (ciphertext). If the data you encrypted was plain text, turn on Decode Base64, so Infisical shows the text instead of its Base64 encoding.

Select Decrypt, then copy your data from Decrypted Data (plaintext).

Call the decrypt endpoint with the ID of the key that encrypted the data:

curl --request POST \
  --url https://app.infisical.com/api/v1/kms/keys/<key-id>/decrypt \
  --header 'Authorization: Bearer <access-token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "ciphertext": "<base64-encoded-ciphertext>"
  }'

If you use EU Cloud or self-host Infisical, replace https://app.infisical.com with https://eu.infisical.com or the address of your instance.

The response contains your data, Base64 encoded:

{
  "plaintext": "SGVsbG8sIFdvcmxkIQ=="
}

If you rotated the key after you encrypted the data, Infisical still decrypts it with the key version that encrypted it.

Key management

KMIP

Integrations

Encrypt and decrypt data

Prerequisites

Encrypt data

Decrypt data

​Prerequisites

​Encrypt data

​Decrypt data

Prerequisites

Encrypt data

Decrypt data