· 5 min · Eanvi
How Eanvi encrypts secrets at rest
AES-256-GCM, random IVs, and a master key that never appears in list responses. A plain-language walkthrough of the encryption layer.
Encryption is a module, not a route handler
Secret values never sit in plaintext in PostgreSQL. The encryption module lives under server/encryption and is the only place that talks to the cipher. Services call encrypt and decrypt. Pages, hooks, and API routes do not implement crypto.
The algorithm is AES-256-GCM. A random 12-byte IV is generated per write. The authentication tag is stored with the ciphertext. The on-disk format is base64(iv + authTag + encryptedData). Tampering fails the GCM check on decrypt.
Keys and reveal
The master key comes from ENCRYPTION_MASTER_KEY and is derived with HKDF. It is never logged and never returned by the API. List endpoints return keys, metadata, and masked values. Plaintext is available only through an explicit reveal that is itself audited.
Key rotation re-encrypts stored values with a new master key. That is an operational task, not a UI toggle — on purpose. Encryption policy belongs in the server layer where it can be tested independently of the dashboard.