Encrypt and decrypt all messages and files
Register a CryptoModule in SDK configuration to encrypt every message before publish and decrypt every received message and downloaded file automatically. No per-call encryption code is required.
For encrypting only selected messages or files, see Encrypt a single item.
Before you start
Confirm you have:
- A PubNub keyset with publish and subscribe keys from Admin Portal.
- A cipher key. Use a 32-character string as the cipher key for AES-256 encryption.
- All clients updated first, if any client on this keyset already encrypts with a
cipherKeysetting and no CryptoModule. An SDK version that doesn't support AES-CBC 256-bit encryption can't decrypt content encrypted with it. Follow Migrate to 256-bit AES-CBC encryption.
Protect your cipher key
Do not share the cipher key outside your app or expose it publicly. All clients that send and receive encrypted content must configure the SDK with the same cipher key.
Register the CryptoModule
Pass the CryptoModule to the PubNub configuration at initialization. The SDK uses AES-CBC 256-bit encryption by default when you call aesCbcCryptoModule.
- JavaScript
- Swift
- Objective-C
- Java
- Go
- Kotlin
- Rust
- Ruby
- Dart
- C#/Unity
1var pubnub = new PubNub({
2 subscribeKey: "mySubscribeKey",
3 publishKey: "myPublishKey",
4 userId: "myUniqueUserId",
5 cryptoModule: PubNub.CryptoModule.aesCbcCryptoModule({cipherKey: 'pubnubenigma'})
6});
1let pubnub = PubNub(
2 configuration: PubNubConfiguration(
3 publishKey: "demo",
4 subscribeKey: "demo",
5 userId: "myUniqueUserId",
6 cryptorModule: CryptorModule.aesCbcCryptoModule(with: "pubnubenigma")
7 )
8)
1// all necessary config options
2config.cryptoModule = [PNCryptoModule AESCBCCryptoModuleWithCipherKey:@"enigma"
3 randomInitializationVector:YES];
1
1config := pubnub.NewConfigWithUserId(UserId("myUniqueUserId"))
2// all necessary config options
3config.CryptoModule = crypto.NewAesCbcCryptoModule("cipherKey", true)
4
5pn := pubnub.NewPubNub(config)
1
1let client = PubNubClientBuilder::with_transport(Transport)
2 // all necessary config options
3 .with_cryptor(CryptoModule::new_aes_cbc_module("enigma", true)?)
4 .build()?;
1pubnub = Pubnub.new(
2 # all necessary config options
3 crypto_module: Crypto::CryptoModule.new_aes_cbc("enigma", true)
4)
1final pubnub =
2 PubNub(
3 // all necessary config options
4 crypto: CryptoModule.aescbcCryptoModule(CipherKey.fromUtf8('enigma'));
5 );
1PNConfiguration pnConfiguration = new PNConfiguration(new UserId("myUniqueUserId"));
2// all necessary config options
3pnConfiguration.CryptoModule = new CryptoModule(new AesCbcCryptor("enigma"), new List<ICryptor> { new LegacyCryptor("enigma") })
4
5new PubNub(pnConfiguration);
After initialization, the SDK encrypts every message before publish and decrypts every message on receive. Signals aren't encrypted in most SDKs. Swift is the exception. Data stored in Message Persistence remains encrypted. Only clients with the same cipher key can read it.
File encryption
File encryption is automatic when a CryptoModule is registered. The SDK encrypts file data before upload and decrypts on download.
Do not pass a cipher key directly to file operations
Passing a cipherKey directly to sendFile or downloadFile bypasses the CryptoModule and forces legacy 128-bit encryption. Configure encryption only through the CryptoModule at initialization.
For SDK-specific examples of sendFile and downloadFile, see the Files API reference for your SDK.