> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Encrypt and decrypt data

> Encrypt and decrypt data with a key in Infisical KMS.

To encrypt data, send it to Infisical with an Encrypt/Decrypt key, and Infisical returns the ciphertext. To read the data again, send the ciphertext back with the same key. Infisical doesn't store your data or the ciphertext.

## Prerequisites

* An [Encrypt/Decrypt key](https://infisical.com/docs/documentation/platform/kms/keys.md#create-a-key)
* The **Member** role to follow the UI steps, or the **Cryptographic Operator** role to follow the API steps (see [Who can use a key](https://infisical.com/docs/documentation/platform/kms/keys.md#who-can-use-a-key))

## Encrypt data

> [tab] Infisical UI
>
> **Step 1**
>
> In your KMS project, go to **Overview**, select the options menu on the key's row, then select **Encrypt Data**.
>
> **Step 2**
>
> Enter your data in **Data (Plaintext)**. If your data is already Base64 encoded, turn on **Data is Base64 encoded**.
>
> **Step 3**
>
> Select **Encrypt**, then copy the ciphertext from **Encrypted Data (Ciphertext)**.

> [tab] API
>
> Base64 encode your data, then call [the encrypt endpoint](https://infisical.com/docs/api-reference/endpoints/kms/encryption/encrypt.md) with the key's ID:
>
> ```bash theme={"dark"}
> curl --request POST \
>   --url https://app.infisical.com/api/v1/kms/keys/<key-id>/encrypt \
>   --header 'Authorization: Bearer <access-token>' \
>   --header 'Content-Type: application/json' \
>   --data '{
>     "plaintext": "SGVsbG8sIFdvcmxkIQ=="
>   }'
> ```
>
> > [!NOTE]
> >
> > If you use EU Cloud or self-host Infisical, replace `https://app.infisical.com` with `https://eu.infisical.com` or the address of your instance.
>
> The response contains the ciphertext:
>
> ```json theme={"dark"}
> {
>   "ciphertext": "<base64-encoded-ciphertext>"
> }
> ```

## Decrypt data

> [tab] Infisical UI
>
> **Step 1**
>
> In your KMS project, go to **Overview**, select the options menu on the row of the key that encrypted the data, then select **Decrypt Data**.
>
> **Step 2**
>
> Paste the ciphertext into **Encrypted Data (ciphertext)**. If the data you encrypted was plain text, turn on **Decode Base64**, so Infisical shows the text instead of its Base64 encoding.
>
> **Step 3**
>
> Select **Decrypt**, then copy your data from **Decrypted Data (plaintext)**.

> [tab] API
>
> Call [the decrypt endpoint](https://infisical.com/docs/api-reference/endpoints/kms/encryption/decrypt.md) with the ID of the key that encrypted the data:
>
> ```bash theme={"dark"}
> curl --request POST \
>   --url https://app.infisical.com/api/v1/kms/keys/<key-id>/decrypt \
>   --header 'Authorization: Bearer <access-token>' \
>   --header 'Content-Type: application/json' \
>   --data '{
>     "ciphertext": "<base64-encoded-ciphertext>"
>   }'
> ```
>
> > [!NOTE]
> >
> > If you use EU Cloud or self-host Infisical, replace `https://app.infisical.com` with `https://eu.infisical.com` or the address of your instance.
>
> The response contains your data, Base64 encoded:
>
> ```json theme={"dark"}
> {
>   "plaintext": "SGVsbG8sIFdvcmxkIQ=="
> }
> ```

If you [rotated the key](https://infisical.com/docs/documentation/platform/kms/key-rotation.md) after you encrypted the data, Infisical still decrypts it with the key version that encrypted it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.