---
source_url: https://www.pubnub.com/docs/sdks/unity/api-reference/encryption
title: Encryption API for Unity SDK
updated_at: 2026-06-26T11:07:06.434Z
sdk_name: PubNub Unity SDK
sdk_version: v9.4.0
---

> Documentation Index
> For a curated overview of PubNub documentation, see: https://www.pubnub.com/docs/llms.txt
> For the full list of all documentation pages, see: https://www.pubnub.com/docs/llms-full.txt


# Encryption API for Unity SDK

PubNub Unity SDK, use the latest version: v9.4.0

PubNub Unity SDK includes message and file encryption. This page shows how to set up the crypto module and how to encrypt and decrypt data. The SDK supports 128-bit Advanced Encryption Standard (AES) and 256-bit AES in Cipher Block Chaining (CBC) mode.

For general SDK configuration and initialization, refer to the [Configuration](https://www.pubnub.com/docs/sdks/unity/api-reference/configuration) page.

## Configuration

### CryptoModule configuration

Use these methods to configure the `CryptoModule` to encrypt all messages and files:

```csharp
using PubnubApi;
using PubnubApi.Unity;

PNConfiguration pnConfiguration = new PNConfiguration(new UserId("myUniqueUserId"));
// encrypts using 256-bit AES-CBC cipher (recommended)
// decrypts data encrypted with the legacy and the 256-bit AES-CBC ciphers
pnConfiguration.CryptoModule = new CryptoModule(new AesCbcCryptor("enigma"),
    new List<ICryptor> { new LegacyCryptor("enigma") });

// encrypts with 128-bit cipher key entropy (legacy)
// decrypts data encrypted with the legacy and the 256-bit AES-CBC ciphers
pnConfiguration.CryptoModule = new CryptoModule(new LegacyCryptor("enigma"),
    new List<ICryptor> { new AesCbcCryptor("enigma") });
```

The client can decrypt content from either module. You can read historical messages and messages from older clients, and you can encrypt new messages with 256-bit AES-CBC.

:::warning Older SDK versions
Apps built using the SDK versions lower than 7.0.1 will **not** be able to decrypt data encrypted using the 256-bit AES-CBC cipher. Make sure to update your clients or encrypt data using the legacy algorithm.
:::

:::note SDK initialization required
Before you use encryption methods, ensure your PubNub client is configured with publish/subscribe keys and a user ID. See the [Configuration guide](https://www.pubnub.com/docs/sdks/unity/api-reference/configuration#initialization) for setup instructions.
:::

## Encryption methods

### Encrypt

Use this function to encrypt data.

:::warning Deprecated
The `cipherKey` parameter in this method is deprecated. We recommend that you configure a separate instance of the [crypto module](https://www.pubnub.com/docs/sdks/unity/api-reference/configuration#cryptomodule) and use it for partial encryption. If you pass `cipherKey` as an argument, it overrides the crypto module configuration and the legacy encryption with 128-bit cipher key entropy is used.
:::

#### Method(s)

To `encrypt` the data you can use the following method(s) in Unity SDK.

```csharp
pubnub.Encrypt(inputString, cipherKey)
```

| Parameter | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| inputString | String | Yes |  | The `data` to `encrypt`. |
| cipherKey | String | Optional |  | Cipher key to use for encryption. |

#### Sample code

:::tip Reference code
This example is a self-contained code snippet ready to be run. It includes necessary imports and executes methods with console logging. Use it as a reference when working with other examples in this document.
:::

##### Encrypt part of a message

```csharp
using PubnubApi;
using PubnubApi.Unity;

// Configuration
PNConfiguration pnConfiguration = new PNConfiguration(new UserId("myUniqueUserId"))
{
    SubscribeKey = "demo",
    PublishKey = "demo",
    Secure = true
};

// Initialize PubNub
Pubnub pubnub = PubnubUnityUtils.NewUnityPubnub(pnConfiguration);

// If you're using Unity Editor setup you can get the Pubnub instance from PNManagerBehaviour
// For more details, see https://www.pubnub.com/docs/sdks/unity#configure-pubnub
/*
[SerializeField] private PNManagerBehaviour pubnubManager;
Pubnub pubnub = pubnubManager.pubnub;
*/

string stringToEncrypt = "hello world";
var crypto = PubnubApi.Security.Crypto.CryptoModule.CreateAesCbcCryptor("test");
crypto.Encrypt(stringToEncrypt);
```

### Encrypt file

Use this function to encrypt file content.

:::warning Deprecated
The `cipherKey` parameter in this method is deprecated. We recommend that you configure a separate instance of the [crypto module](https://www.pubnub.com/docs/sdks/unity/api-reference/configuration#cryptomodule) and use it for partial encryption. If you pass `cipherKey` as an argument, it overrides the crypto module configuration and the legacy encryption with 128-bit cipher key entropy is used.
:::

#### Method(s)

To `encrypt` the file you can use the following method(s) in Unity SDK.

```csharp
pubnub.EncryptFile(sourceFile, destinationFile, cipherKey)
```

| Parameter | Description |
| --- | --- |
| `sourceFile` *Type: String | File to be encrypted. |
| `destinationFile` *Type: String | Path of the encrypted file to be saved. |
| `cipherKey`Type: String | Cipher Key to use for encryption. If provided, the legacy encryption with 128-bit cipher key entropy is used. If not provided, the `CryptoModule` from PubNub config will be used. For more information, refer to [Crypto module configuration](https://www.pubnub.com/docs/sdks/unity/api-reference/configuration#cryptomodule). |

```csharp
byte[] outputBytes = pubnub.EncryptFile(sourceBytes) byte[] outputBytes = pubnub.EncryptFile(sourceBytes, cipherKey)
```

| Parameter | Description |
| --- | --- |
| `sourceBytes` *Type: byte[] | byte array of the file. |
| `cipherKey`Type: String | Cipher Key to use for encryption. If provided, the legacy encryption with 128-bit cipher key entropy is used. If not provided, the `CryptoModule` from PubNub config will be used. For more information, refer to [Crypto module configuration](https://www.pubnub.com/docs/sdks/unity/api-reference/configuration#cryptomodule). |

#### Sample code

```csharp
using PubnubApi;
using PubnubApi.Unity;

// Configuration
PNConfiguration pnConfiguration = new PNConfiguration(new UserId("myUniqueUserId"))
{
    SubscribeKey = "demo",
    PublishKey = "demo",
    Secure = true
};

// Initialize PubNub
Pubnub pubnub = PubnubUnityUtils.NewUnityPubnub(pnConfiguration);

// If you're using Unity Editor setup you can get the Pubnub instance from PNManagerBehaviour
// For more details, see https://www.pubnub.com/docs/sdks/unity#configure-pubnub
/*
[SerializeField] private PNManagerBehaviour pubnubManager;
Pubnub pubnub = pubnubManager.pubnub;
*/

string source_file = "cat_picture.jpg"; // checks bin folder if no path is provided
string destination_file = "destination_cat_pic.jpg"; // checks bin folder if no path is provided
var crypto = PubnubApi.Security.Crypto.CryptoModule.CreateAesCbcCryptor("test");
crypto.EncryptFile(source_file, destination_file);
```

```csharp
using PubnubApi;
using PubnubApi.Unity;

// Configuration
PNConfiguration pnConfiguration = new PNConfiguration(new UserId("myUniqueUserId"))
{
    SubscribeKey = "demo",
    PublishKey = "demo",
    Secure = true
};

// Initialize PubNub
Pubnub pubnub = PubnubUnityUtils.NewUnityPubnub(pnConfiguration);

// If you're using Unity Editor setup you can get the Pubnub instance from PNManagerBehaviour
// For more details, see https://www.pubnub.com/docs/sdks/unity#configure-pubnub
/*
[SerializeField] private PNManagerBehaviour pubnubManager;
Pubnub pubnub = pubnubManager.pubnub;
*/

byte[] sourceBytes = System.IO.File.ReadAllBytes("cat_picture.jpg"); // checks bin folder if no path is provided
var crypto = PubnubApi.Security.Crypto.CryptoModule.CreateAesCbcCryptor("test");
byte[] outputBytes = crypto.Encrypt(sourceBytes);
System.IO.File.WriteAllBytes("destination_cat_pic.jpg", outputBytes); // checks bin folder if no path is provided
```

## Decryption methods

### Decrypt

Use this function to decrypt data.

:::warning Deprecated
The `cipherKey` parameter in this method is deprecated. We recommend that you configure a separate instance of the [crypto module](https://www.pubnub.com/docs/sdks/unity/api-reference/configuration#cryptomodule) and use it for partial encryption. If you pass `cipherKey` as an argument, it overrides the crypto module configuration and the legacy encryption with 128-bit cipher key entropy is used.
:::

#### Method(s)

To `decrypt` the data you can use the following method(s) in Unity SDK.

```csharp
pubnub.Decrypt(inputString, cipherKey)
```

| Parameter | Description |
| --- | --- |
| `inputString` *Type: String | The `data` to `decrypt`. |
| `cipherKey`Type: String | Cipher key used for decryption. |

#### Sample code

##### Decrypt part of a message

```csharp
using PubnubApi;
using PubnubApi.Unity;

// Configuration
PNConfiguration pnConfiguration = new PNConfiguration(new UserId("myUniqueUserId"))
{
    SubscribeKey = "demo",
    PublishKey = "demo",
    Secure = true
};

// Initialize PubNub
Pubnub pubnub = PubnubUnityUtils.NewUnityPubnub(pnConfiguration);

// If you're using Unity Editor setup you can get the Pubnub instance from PNManagerBehaviour
// For more details, see https://www.pubnub.com/docs/sdks/unity#configure-pubnub
/*
[SerializeField] private PNManagerBehaviour pubnubManager;
Pubnub pubnub = pubnubManager.pubnub;
*/

var crypto = PubnubApi.Security.Crypto.CryptoModule.CreateAesCbcCryptor("test");
crypto.Decrypt("encryptedString");
```

### Decrypt file

Use this function to decrypt file content.

:::warning Deprecated
The `cipherKey` parameter in this method is deprecated. We recommend that you configure a separate instance of the [crypto module](https://www.pubnub.com/docs/sdks/unity/api-reference/configuration#cryptomodule) and use it for partial encryption. If you pass `cipherKey` as an argument, it overrides the crypto module configuration and the legacy encryption with 128-bit cipher key entropy is used.
:::

#### Method(s)

To `decrypt` the file you can use the following method(s) in Unity SDK.

```csharp
pubnub.DecryptFile(sourceFile, destinationFile, cipherKey);
```

| Parameter | Description |
| --- | --- |
| `sourceFile` *Type: String | File to be decrypted. |
| `destinationFile` *Type: String | Path of the decrypted file to be saved. |
| `cipherKey`Type: String | Cipher Key to use for decryption. If provided, the legacy encryption with 128-bit cipher key entropy is used. If not provided, the `CryptoModule` from PubNub config will be used. For more information, refer to [Crypto module configuration](https://www.pubnub.com/docs/sdks/unity/api-reference/configuration#cryptomodule). |

```csharp
byte[] outputBytes = pubnub.DecryptFile(sourceBytes) byte[] outputBytes = pubnub.DecryptFile(sourceBytes, cipherKey)
```

| Parameter | Description |
| --- | --- |
| `sourceBytes` *Type: byte[] | byte array of the file. |
| `cipherKey`Type: String | Cipher Key to use for decryption. If provided, the legacy encryption with 128-bit cipher key entropy is used. If not provided, the `CryptoModule` from PubNub config will be used. For more information, refer to [Crypto module configuration](https://www.pubnub.com/docs/sdks/unity/api-reference/configuration#cryptomodule). |

#### Sample code

```csharp
using PubnubApi;
using PubnubApi.Unity;

// Configuration
PNConfiguration pnConfiguration = new PNConfiguration(new UserId("myUniqueUserId"))
{
    SubscribeKey = "demo",
    PublishKey = "demo",
    Secure = true
};

// Initialize PubNub
Pubnub pubnub = PubnubUnityUtils.NewUnityPubnub(pnConfiguration);

// If you're using Unity Editor setup you can get the Pubnub instance from PNManagerBehaviour
// For more details, see https://www.pubnub.com/docs/sdks/unity#configure-pubnub
/*
[SerializeField] private PNManagerBehaviour pubnubManager;
Pubnub pubnub = pubnubManager.pubnub;
*/

string source_file = "encrypted_cat_pic.jpg"; // checks bin folder if no path is provided
string destination_file = "cat_pic_original.jpg"; // checks bin folder if no path is provided
var crypto = PubnubApi.Security.Crypto.CryptoModule.CreateAesCbcCryptor("test");
crypto.DecryptFile(source_file, destination_file);
```

```csharp
using PubnubApi;
using PubnubApi.Unity;

// Configuration
PNConfiguration pnConfiguration = new PNConfiguration(new UserId("myUniqueUserId"))
{
    SubscribeKey = "demo",
    PublishKey = "demo",
    Secure = true
};

// Initialize PubNub
Pubnub pubnub = PubnubUnityUtils.NewUnityPubnub(pnConfiguration);

// If you're using Unity Editor setup you can get the Pubnub instance from PNManagerBehaviour
// For more details, see https://www.pubnub.com/docs/sdks/unity#configure-pubnub
/*
[SerializeField] private PNManagerBehaviour pubnubManager;
Pubnub pubnub = pubnubManager.pubnub;
*/

byte[] sourceBytes = System.IO.File.ReadAllBytes("encrypted_cat_pic.jpg"); // checks bin folder if no path is provided
var crypto = PubnubApi.Security.Crypto.CryptoModule.CreateAesCbcCryptor("test");
byte[] outputBytes = crypto.Decrypt(sourceBytes);
System.IO.File.WriteAllBytes("cat_pic_original.jpg", outputBytes); // checks bin folder if no path is provided
```

## Terms in this document

* **Publish Key** - A unique identifier that allows your application to send messages to PubNub channels. It's part of your app's credentials and should be kept secure.
* **Subscribe Key** - A unique identifier that allows your application to receive messages from PubNub channels. It's part of your app's credentials and should be kept secure.
* **User** - An individual or entity that interacts with a system, application, or service. In PubNub, a user typically refers to someone who sends or receives messages through the platform, identified by a unique user ID or username.
* **User ID** - UTF-8 encoded, unique string of up to 92 characters used to identify a single client (end user, device, or server) that connects to PubNub.