---
source_url: https://www.pubnub.com/docs/security/encryption/encrypt-all-messages-and-files
title: Encrypt and decrypt all messages and files
description: Register a CryptoModule at SDK initialization to automatically encrypt every message and file your app sends and receives.
updated_at: 2026-11-09T13:29:01.000Z
---

# Encrypt and decrypt all messages and files

> For AI agents: documentation index at https://www.pubnub.com/llms-full.txt

Register a CryptoModule in SDK configuration to encrypt every message before publish and decrypt every received message and downloaded file automatically. No per-call encryption code is required.

For encrypting only selected messages or files, see [Encrypt a single item](https://www.pubnub.com/docs/security/encryption/encrypt-single-item.md).

## Before you start

Confirm you have:

* A PubNub keyset with publish and subscribe keys from [Admin Portal](https://admin.pubnub.com/).
* A cipher key. Use a 32-character string as the cipher key for AES-256 encryption.
* All clients updated first, if any client on this keyset already encrypts with a `cipherKey` setting and no CryptoModule. An SDK version that doesn't support AES-CBC 256-bit encryption can't decrypt content encrypted with it. Follow [Migrate to 256-bit AES-CBC encryption](https://www.pubnub.com/docs/migration-guides/aes-cbc-encryption.md).

:::warning Protect your cipher key
Do not share the cipher key outside your app or expose it publicly. All clients that send and receive encrypted content must configure the SDK with the same cipher key.
:::

## Register the CryptoModule

Pass the CryptoModule to the PubNub configuration at initialization. The SDK uses AES-CBC 256-bit encryption by default when you call `aesCbcCryptoModule`.

### JavaScript

```javascript
var pubnub = new PubNub({
  subscribeKey: "mySubscribeKey",
  publishKey: "myPublishKey",
  userId: "myUniqueUserId",
  cryptoModule: PubNub.CryptoModule.aesCbcCryptoModule({cipherKey: 'pubnubenigma'})
});
```

### Swift

```swift
let pubnub = PubNub(
  configuration: PubNubConfiguration(
    publishKey: "demo",
    subscribeKey: "demo",
    userId: "myUniqueUserId",
    cryptorModule: CryptorModule.aesCbcCryptoModule(with: "pubnubenigma")
  )
)
```

### Objective-C

```objectivec
// all necessary config options
config.cryptoModule = [PNCryptoModule AESCBCCryptoModuleWithCipherKey:@"enigma"
                                          randomInitializationVector:YES];
```

### Java

```java
PNConfiguration.Builder configBuilder = PNConfiguration.builder(new UserId("yourUserId"), "yourSubscribeKey");
// publishKey from Admin Portal (only required if publishing)
configBuilder.publishKey("PublishKey");
configBuilder.cryptoModule(CryptoModule.createAesCbcCryptoModule("pn-9F3kQ7zR2xV8mB1tD6wL4yH0sN5cJ", true));
// all necessary config options
PubNub pubNub = PubNub.create(configBuilder.build());
```

### Go

```go
config := pubnub.NewConfigWithUserId(UserId("myUniqueUserId"))
// all necessary config options
config.CryptoModule = crypto.NewAesCbcCryptoModule("cipherKey", true)

pn := pubnub.NewPubNub(config)
```

### Kotlin

```kotlin
val config = com.pubnub.api.v2.PNConfiguration.builder(UserId("myUserId"), "demo").apply {
    publishKey = "demo"
    cryptoModule = CryptoModule.createAesCbcCryptoModule("pn-9F3kQ7zR2xV8mB1tD6wL4yH0sN5cJ")
}.build()

val pubnub = PubNub.create(config)
```

### Rust

```rust
let client = PubNubClientBuilder::with_transport(Transport)
    // all necessary config options
    .with_cryptor(CryptoModule::new_aes_cbc_module("enigma", true)?)
    .build()?;
```

### Ruby

```ruby
pubnub = Pubnub.new(
    # all necessary config options
    crypto_module: Crypto::CryptoModule.new_aes_cbc("enigma", true)
)
```

### Dart

```dart
final pubnub =
  PubNub(
    // all necessary config options
    crypto: CryptoModule.aescbcCryptoModule(CipherKey.fromUtf8('enigma'));
  );
```

### C#/Unity

```csharp
PNConfiguration pnConfiguration = new PNConfiguration(new UserId("myUniqueUserId"));
// all necessary config options
pnConfiguration.CryptoModule = new CryptoModule(new AesCbcCryptor("enigma"), new List<ICryptor> { new LegacyCryptor("enigma") })

new PubNub(pnConfiguration);
```

After initialization, the SDK encrypts every message before publish and decrypts every message on receive. Signals aren't encrypted in most SDKs. Swift is the exception. Data stored in [Message Persistence](https://www.pubnub.com/docs/data-storage/message-history/overview.md) remains encrypted. Only clients with the same cipher key can read it.

## File encryption

File encryption is automatic when a CryptoModule is registered. The SDK encrypts file data before upload and decrypts on download.

:::warning Do not pass a cipher key directly to file operations
Passing a `cipherKey` directly to `sendFile` or `downloadFile` bypasses the CryptoModule and forces legacy 128-bit encryption. Configure encryption only through the CryptoModule at initialization.
:::

For SDK-specific examples of `sendFile` and `downloadFile`, see the [Files API reference](https://www.pubnub.com/docs/sdks/javascript/api-reference/file-sharing.md) for your SDK.

Last updated at: 2026-11-09T13:29:01.000Z