---
source_url: https://www.pubnub.com/docs/sdks/unreal/api-reference/encryption
title: Encryption API for Unreal SDK
updated_at: 2026-05-22T11:08:03.777Z
sdk_name: PubNub Unreal SDK
sdk_version: 2.0.5
---

> Documentation Index
> For a curated overview of PubNub documentation, see: https://www.pubnub.com/docs/llms.txt
> For the full list of all documentation pages, see: https://www.pubnub.com/docs/llms-full.txt


# Encryption API for Unreal SDK

PubNub Unreal SDK, use the latest version: 2.0.5

##### Usage in Blueprints and C++

You can use PubNub's functionality via Blueprints or directly in C++ code.

* In Blueprints, the SDK is managed by a subsystem. Start by calling the Pubnub Subsystem node, then use Create Pubnub Client to create a UPubnubClient instance.
* In a C++ project, you have to add a dependency to PubnubLibrary: In your IDE, navigate to Source/_{YourProject}_/_{YourProject}_.Build.cs and add a dependency to PubnubLibrary. PrivateDependencyModuleNames.AddRange(new string[] { "PubnubLibrary" });, Compile the code and run the project.
* In C++, start by getting the UPubnubSubsystem (a Game Instance Subsystem), then create a UPubnubClient with your configuration. #include "Kismet/GameplayStatics.h"#include "PubnubSubsystem.h"#include "PubnubClient.h" UGameInstance* GameInstance = UGameplayStatics::GetGameInstance(this);UPubnubSubsystem* PubnubSubsystem = GameInstance->GetSubsystem<UPubnubSubsystem>(); FPubnubConfig Config;Config.PublishKey = "pub-c-...";Config.SubscribeKey = "sub-c-...";Config.UserId = "my-user-id"; UPubnubClient* PubnubClient = PubnubSubsystem->CreatePubnubClient(Config); PubnubClient allows you to call PubNub SDK functions, for example: PubnubClient->PublishMessageAsync("my-channel", "Hello!", OnPublishMessageResponseDelegate); The SDK supports multiple UPubnubClient instances within the same game for different contexts such as different users or keysets. For more information, refer to Configuration.

:::note Synchronous API
Encryption methods (`SetCryptoModule`, `GetCryptoModule`) are synchronous only; there are no async variants. Configure the crypto module on each `UPubnubClient` when using the Client API. When using multiple clients, each client has its own crypto module.
:::

PubNub Unreal SDK includes message encryption. This documentation covers crypto module configuration and utility methods for encrypting and decrypting messages using both legacy 128-bit and enhanced 256-bit AES-CBC encryption.

For general SDK configuration and initialization, refer to the [Configuration](https://www.pubnub.com/docs/sdks/unreal/api-reference/configuration) page.

## Configuration

The crypto system in Unreal SDK consists of three main components:

1. Cryptors (`IPubnubCryptorInterface`), which are individual encryption algorithms (AES, Legacy)
2. Provider interface (`UPubnubCryptoModule`), which is the top-level interface used by each PubNub client.
3. Crypto module (`IPubnubCryptoProviderInterface`), which manages multiple cryptors with automatic algorithm selection.

To configure the crypto module for a client so that all messages are encrypted, use `SetCryptoModule` and `GetCryptoModule` on the `UPubnubClient` instance. When using multiple clients, set the crypto module on each client that should use encryption.

:::note Automatic message encryption/decryption
Once configured, the crypto module automatically handles encryption and decryption:
* All published messages are encrypted using the default cryptor
* Received messages and fetched history messages are automatically decrypted using the appropriate cryptor (determined by the 4-byte identifier in the message header)
:::

### Set crypto module

Sets the crypto module for this client. All messages published or received by this client will use this module for encryption and decryption.

```cpp
PubnubClient->SetCryptoModule(TScriptInterface<IPubnubCryptoProviderInterface> CryptoModule);
```

| Parameter | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| CryptoModule | TScriptInterface<IPubnubCryptoProviderInterface> | Yes |  | The crypto module object that implements `IPubnubCryptoProviderInterface`. Use `UPubnubCryptoModule` for the default PubNub encryption implementation. |

#### Returns

This method does not return a value.

#### Sample code

To set the crypto module and configure AES encryption/decryption for all messages for this client:

##### C++

##### Actor.h

```cpp
#include "PubnubClient.h"

// blueprint.kvmh9-q4
UFUNCTION(BlueprintCallable, Category = "Pubnub|Samples|Crypto")
void SetCryptoModuleSample();
```

##### Actor.cpp

```cpp
// ACTION REQUIRED: Replace ASample_Crypto with name of your Actor class
void ASample_Crypto::SetCryptoModuleSample()
{
	// snippet.hide
	UPubnubClient* PubnubClient = GetPubnubClient();
	// snippet.show
	
	//Assumes PubnubClient is created and UserID is set

	// Create Aes Cryptor - our main encryption algorithm
	UPubnubAesCryptor* AesCryptor = NewObject<UPubnubAesCryptor>(this);
	AesCryptor->SetCipherKey("enigma");

	// Create CryptoModule and Init it with Aes Cryptor
	UPubnubCryptoModule* CryptoModule = NewObject<UPubnubCryptoModule>(this);
	CryptoModule->InitCryptoModule(AesCryptor, {});

	// Set CryptoModule to Pubnub Client
	PubnubClient->SetCryptoModule(CryptoModule);
}
```

##### Blueprint

### Get crypto module

Returns the crypto module currently set for this client.

```cpp
TScriptInterface<IPubnubCryptoProviderInterface> CryptoModule = PubnubClient->GetCryptoModule();
```

#### Returns

| Type | Description |
| --- | --- |
| `TScriptInterface<IPubnubCryptoProviderInterface>` | The crypto module previously set with `SetCryptoModule()` for this client. Returns an empty interface if none was set. |

#### Sample code

To get the crypto module for the current client:

##### C++

##### Actor.h

```cpp
#include "PubnubClient.h"

// blueprint.wpnnrw6k
UFUNCTION(BlueprintCallable, Category = "Pubnub|Samples|Crypto")
void GetCryptoModuleSample();
```

##### Actor.cpp

```cpp
void ASample_Crypto::GetCryptoModuleSample()
{
	// snippet.hide
	UPubnubClient* PubnubClient = GetPubnubClient();
	// snippet.show
	
	//Assumes PubnubClient is created and UserID is set

	// Get Crypto Module - assuming CryptoModule was already set
	TScriptInterface<IPubnubCryptoProviderInterface> CryptoModuleInterface = PubnubClient->GetCryptoModule();

	//Get Crypto Module as Object
	UObject* CryptoModuleObject = CryptoModuleInterface.GetObject();

	// CryptoModule needs to be validated before use
	if(CryptoModuleObject)
	{
		//Use your CryptoModule
	}
}
```

##### Blueprint

### Available cryptors

The Unreal SDK provides two built-in cryptor implementations:

#### AES cryptor (UPubnubAesCryptor)

Uses 256-bit AES-CBC encryption with PKCS#7 padding. This is the recommended cryptor for new applications.

| Feature | Description |
| --- | --- |
| Identifier | `'A', 'C', 'R', 'H'` (4-byte header identifier) |
| Key management | Set cipher key using `SetCipherKey(FString)` |
| IV generation | Generates random 16-byte IV for each encryption |
| Compatibility | Compatible with PubNub AES encryption across all SDKs |

#### Legacy cryptor (UPubnubLegacyCryptor)

Provides compatibility with older PubNub encryption implementations while encrypting messages with the AES cryptor. Use the AES cryptor if you don't need to decrypt legacy messages.

:::warning Legacy cryptor usage
Useful when your Unreal SDK must be able to decrypt messages encrypted with the legacy PubNub encryption from other SDKs.
:::

| Feature | Description |
| --- | --- |
| Identifier | `{0, 0, 0, 0}` (4-byte legacy identifier) |
| Key management | Set cipher key using `SetCipherKey(FString)` |
| IV options | Supports both random IV (default) and fixed IV modes |
| Compatibility | Compatible with legacy PubNub encryption |

#### Legacy configuration

To configure legacy decryption for all messages:

##### Actor.h

```cpp
#include "PubnubClient.h"

UFUNCTION(BlueprintCallable, Category = "Pubnub|Samples|Crypto")
void SetCryptoModuleWithLegacySample();
	
```

##### Actor.cpp

```cpp
#include "Crypto/PubnubLegacyCryptor.h"

// ACTION REQUIRED: Replace ASample_Crypto with name of your Actor class
void ASample_Crypto::SetCryptoModuleWithLegacySample()
{
	// snippet.hide
	UPubnubClient* PubnubClient = GetPubnubClient();
	// snippet.show
	
	//Assumes PubnubClient is created and UserID is set

	// Create Aes Cryptor - our main encryption algorithm
	UPubnubAesCryptor* AesCryptor = NewObject<UPubnubAesCryptor>(this);
	AesCryptor->SetCipherKey("enigma");

	// Create Legacy Cryptor
	// Legacy Cryptor is only needed if you need compatibility with other PubNub SDKs that already use Legacy encryption
	UPubnubLegacyCryptor* LegacyCryptor = NewObject<UPubnubLegacyCryptor>(this);
	LegacyCryptor->SetCipherKey("enigma");

	// Create CryptoModule and Init it with Aes Cryptor as the default Cryptor and Legacy Cryptor as an additional one
	UPubnubCryptoModule* CryptoModule = NewObject<UPubnubCryptoModule>(this);
	CryptoModule->InitCryptoModule(AesCryptor, {LegacyCryptor});

	// Set CryptoModule to Pubnub Client
	PubnubClient->SetCryptoModule(CryptoModule);
}
```

### Custom cryptors

To use a custom cryptor, you need to implement the `IPubnubCryptorInterface` interface. For more information, refer to the [Data security](https://www.pubnub.com/docs/general/setup/data-security#custom-encryption) section.

## Encrypt

This function allows you to encrypt data manually using the configured crypto module.

### Method(s)

To encrypt data you can use the following method in the Unreal SDK:

```cpp
IPubnubCryptoProviderInterface::Execute_ProviderEncrypt(CryptoModule, Message);
```

| Parameter | Description |
| --- | --- |
| `CryptoModule` *Type: `UObject*` | The crypto module object that implements `IPubnubCryptoProviderInterface`. |
| `Message` *Type: `FString` | The plaintext data to encrypt. |

### Sample code

#### Actor.h

```cpp
#include "PubnubClient.h"

UFUNCTION(BlueprintCallable, Category = "Pubnub|Samples|Crypto")
void ProviderEncryptSample();
```

#### Actor.cpp

```cpp
// ACTION REQUIRED: Replace ASample_Crypto with name of your Actor class
void ASample_Crypto::ProviderEncryptSample()
{
	// Create Aes Cryptor - our main encryption algorithm
	UPubnubAesCryptor* AesCryptor = NewObject<UPubnubAesCryptor>(this);
	AesCryptor->SetCipherKey("enigma");

	// Create CryptoModule and Init it with Aes Cryptor
	UPubnubCryptoModule* CryptoModule = NewObject<UPubnubCryptoModule>(this);
	CryptoModule->InitCryptoModule(AesCryptor, {});

	FString MessageToEncrypt = TEXT("Ready for action!");
	FString EncryptedMessage = IPubnubCryptoProviderInterface::Execute_ProviderEncrypt(CryptoModule, MessageToEncrypt);
}
```

### Other examples

#### Encrypt using a module set during configuration

##### Actor.h

```cpp
#include "PubnubClient.h"

UFUNCTION(BlueprintCallable, Category = "Pubnub|Samples|Crypto")
void ProviderEncryptUsingAlreadySetModuleSample();
```

##### Actor.cpp

```cpp
// ACTION REQUIRED: Replace ASample_Crypto with name of your Actor class
void ASample_Crypto::ProviderEncryptUsingAlreadySetModuleSample()
{
	// snippet.hide
	UPubnubClient* PubnubClient = GetPubnubClient();
	// snippet.show
	
	//Assumes PubnubClient is created and UserID is set

	// Get Crypto Module - assuming CryptoModule was already set
	TScriptInterface<IPubnubCryptoProviderInterface> CryptoModule = PubnubClient->GetCryptoModule();

	UObject* CryptoModuleObject = CryptoModule.GetObject();

	if(CryptoModuleObject)
	{
		FString MessageToEncrypt = TEXT("Ready for action!");
		FString EncryptedMessage = IPubnubCryptoProviderInterface::Execute_ProviderEncrypt(CryptoModuleObject, MessageToEncrypt);
	}
}
```

### Returns

Returns the encrypted message as a Base64-encoded `FString` or an empty string if encryption fails.

## Decrypt

This function allows you to decrypt data manually using the configured crypto module.

### Method(s)

To decrypt data you can use the following method in the Unreal SDK:

```cpp
IPubnubCryptoProviderInterface::Execute_ProviderDecrypt(CryptoModule, EncryptedMessage);
```

| Parameter | Description |
| --- | --- |
| `CryptoModule` *Type: `UObject*` | The crypto module object that implements `IPubnubCryptoProviderInterface`. |
| `EncryptedMessage` *Type: `FString` | The Base64-encoded encrypted data to decrypt. |

### Sample code

#### Actor.h

```cpp
#include "PubnubClient.h"

UFUNCTION(BlueprintCallable, Category = "Pubnub|Samples|Crypto")
void ProviderDecryptSample();
```

#### Actor.cpp

```cpp
// ACTION REQUIRED: Replace ASample_Crypto with name of your Actor class
void ASample_Crypto::ProviderDecryptSample()
{
	// Create Aes Cryptor - our main encryption algorithm
	UPubnubAesCryptor* AesCryptor = NewObject<UPubnubAesCryptor>(this);
	AesCryptor->SetCipherKey("enigma");

	// Create CryptoModule and Init it with Aes Cryptor
	UPubnubCryptoModule* CryptoModule = NewObject<UPubnubCryptoModule>(this);
	CryptoModule->InitCryptoModule(AesCryptor, {});
	
	FString EncryptedMessage = TEXT("UE5FRAFBQ1JIEAiPzR+6d0U+p/7iTcrvsBuoiJEjvqP90rLD8iC1NKLr7AQJFUv7NiI1pIRZKmtFWQ==");
	FString DecryptedMessage = IPubnubCryptoProviderInterface::Execute_ProviderDecrypt(CryptoModule, EncryptedMessage);
}
```

### Other examples

#### Decrypt using a module set during configuration

##### Actor.h

```cpp
#include "PubnubClient.h"

UFUNCTION(BlueprintCallable, Category = "Pubnub|Samples|Crypto")
void ProviderDecryptUsingAlreadySetModuleSample();
	
```

##### Actor.cpp

```cpp
// ACTION REQUIRED: Replace ASample_Crypto with name of your Actor class
void ASample_Crypto::ProviderDecryptUsingAlreadySetModuleSample()
{
	// snippet.hide
	UPubnubClient* PubnubClient = GetPubnubClient();
	// snippet.show
	
	//Assumes PubnubClient is created and UserID is set

	// Get Crypto Module - assuming CryptoModule was already set
	TScriptInterface<IPubnubCryptoProviderInterface> CryptoModuleInterface = PubnubClient->GetCryptoModule();

	UObject* CryptoModuleObject = CryptoModuleInterface.GetObject();

	if(CryptoModuleObject)
	{
		FString EncryptedMessage = TEXT("UE5FRAFBQ1JIEAiPzR+6d0U+p/7iTcrvsBuoiJEjvqP90rLD8iC1NKLr7AQJFUv7NiI1pIRZKmtFWQ==");
		FString DecryptedMessage = IPubnubCryptoProviderInterface::Execute_ProviderDecrypt(CryptoModuleObject, EncryptedMessage);
	}
}
```

### Returns

Returns the decrypted message as a plaintext `FString` or an empty string if decryption fails.

## Set crypto module (deprecated)

:::warning Deprecated
Use `PubnubClient->SetCryptoModule()` instead. Crypto configuration is per client when using the Client API.
:::

```cpp
PubnubSubsystem->SetCryptoModule(TScriptInterface<IPubnubCryptoProviderInterface> CryptoModule);
```

| Parameter | Description |
| --- | --- |
| `CryptoModule` *Type: `TScriptInterface<IPubnubCryptoProviderInterface>` | The crypto module object that implements `IPubnubCryptoProviderInterface`. |

## Get crypto module (deprecated)

:::warning Deprecated
Use `PubnubClient->GetCryptoModule()` instead. Each client has its own crypto module when using the Client API.
:::

```cpp
PubnubSubsystem->GetCryptoModule();
```

#### Returns

Returns the crypto module object that implements `IPubnubCryptoProviderInterface` which was set using `SetCryptoModule()` on the default client. If no crypto module was set, returns an empty interface.

## Complete example

:::tip Reference code
Set up your Unreal project and follow the instructions in the lines marked with
ACTION REQUIRED
before running the code.
:::

#### ASample_CryptoFull.h

```cpp
#pragma once

#include "PubnubClient.h"

#include "GameFramework/Actor.h"
#include "CoreMinimal.h"
#include "Sample_CryptoFull.generated.h"

// ACTION REQUIRED: Replace PUBNUBLIBRARYTESTS_API with your project's module API macro (usually ProjectName_API)
UCLASS()
class PUBNUBLIBRARYTESTS_API ASample_CryptoFull : public AActor
{
	GENERATED_BODY()

protected:
	virtual void BeginPlay() override;

public:

	UFUNCTION(BlueprintCallable, Category = "Pubnub|FullExamples|Crypto")
	void RunCryptoFullExample();

	UFUNCTION()
	void OnPubnubMessageReceived(FPubnubMessageData Message);

	UFUNCTION()
	void OnPublishResult(FPubnubOperationResult Result, FPubnubMessageData Message);

private:
	UPROPERTY()
	UPubnubClient* PubnubClient = nullptr;
};
```

#### ASample_CryptoFull.cpp

```cpp
#include "Samples/Sample_CryptoFull.h"
#include "Kismet/GameplayStatics.h"
#include "Engine/GameInstance.h"
#include "Crypto/PubnubAesCryptor.h"
#include "Crypto/PubnubCryptoModule.h"
#include "PubnubSubsystem.h"
#include "PubnubClient.h"

void ASample_CryptoFull::BeginPlay()
{
	Super::BeginPlay();

	//Run the example on BeginPlay
	RunCryptoFullExample();
}

void ASample_CryptoFull::RunCryptoFullExample()
{
	//Get PubnubSubsystem from GameInstance
	UGameInstance* GameInstance = UGameplayStatics::GetGameInstance(this);
	UPubnubSubsystem* PubnubSubsystem = GameInstance->GetSubsystem<UPubnubSubsystem>();
	
	//Create Pubnub Client using Pubnub Subsystem
	FPubnubConfig Config;
	Config.PublishKey = TEXT("demo");   //replace with your Publish Key from Admin Portal
	Config.SubscribeKey = TEXT("demo"); //replace with your Subscribe Key from Admin Portal
	Config.UserID = TEXT("Player_001");
	PubnubClient = PubnubSubsystem->CreatePubnubClient(Config);

	UE_LOG(LogTemp, Log, TEXT("Crypto example, Pubnub Client is created"));
	
	// Set Crypto Module With Aes Cryptor
	// Setting crypto module automatically encrypts all published messages and decrypts received messages
	// Messages fetched from history are alsodecrypted automatically
	UPubnubAesCryptor* AesCryptor = NewObject<UPubnubAesCryptor>(this);
	AesCryptor->SetCipherKey("enigma");
	UPubnubCryptoModule* CryptoModule = NewObject<UPubnubCryptoModule>(this);
	CryptoModule->InitCryptoModule(AesCryptor, {});
	PubnubClient->SetCryptoModule(CryptoModule);

	UE_LOG(LogTemp, Log, TEXT("Crypto example, Crypto Module is set"));

	//Add Listener/Delegate that will broadcast whenever message is received on any subscribed channel or group
	PubnubClient->OnMessageReceived.AddDynamic(this, &ASample_CryptoFull::OnPubnubMessageReceived);

	//Subscribe to the Channel
	FString Channel = TEXT("secret_guild_chat");
	PubnubClient->SubscribeToChannelAsync(Channel);

	// NOTE: Subscribing to a group or channel may take a few seconds to complete.
	// This sleep is used to simulate the waiting period in an actual application.
	FPlatformProcess::Sleep(3);
	
	UE_LOG(LogTemp, Log, TEXT("Crypto example, subscribed to channel: %s"), *Channel);
		
	//Bind delegate to the publish result
	FOnPubnubPublishMessageResponse OnPublishMessageResponse;
	OnPublishMessageResponse.BindDynamic(this, &ASample_CryptoFull::OnPublishResult);
	
	//Publish message to the subscribed channel - this message will be encrypted automatically because crypto module is set
	FString Message = R"({"event": "PowerUpUsed", "powerup": "Invisibility Cloak", "duration": 10})";
	PubnubClient->PublishMessageAsync(Channel, Message, OnPublishMessageResponse);

	// NOTE: Give some time to receive message before unsubscribing
	// This sleep is used only to simulate the waiting period in an actual application.
	FPlatformProcess::Sleep(3);
	
	//Unsubscribe from previously subscribed channel
	PubnubClient->UnsubscribeFromChannelAsync(Channel);

	UE_LOG(LogTemp, Log, TEXT("Crypto example, message published"));
}

void ASample_CryptoFull::OnPubnubMessageReceived(FPubnubMessageData Message)
{
	UE_LOG(LogTemp, Log, TEXT("Crypto example, message received on Channel: %s, Message Content: %s"), *Message.Channel, *Message.Message);
}

void ASample_CryptoFull::OnPublishResult(FPubnubOperationResult Result, FPubnubMessageData Message)
{
	if(Result.Error)
	{
		UE_LOG(LogTemp, Error, TEXT("Crypto example, failed to publish message. Status: %d, Reason: %s"), Result.Status, *Result.ErrorMessage);
	}
	else
	{
		UE_LOG(LogTemp, Log, TEXT("Crypto example, message published successfully. Published message timetoken: %s"), *Message.Timetoken);
	}
}
```