Encryption

Arweave has no built-in encryption. All encryption and decryption must be handled client-side before uploading data to the network. Arweave is completely data-agnostic - it stores whatever data you provide without any knowledge of whether it's encrypted or not.

How Encryption Works on Arweave

Critical Points:

• No native encryption: Arweave provides no encryption services whatsoever
• Client-side only: You must encrypt data before uploading
• Data-agnostic storage: Arweave stores any data type, including encrypted data
• Your responsibility: You handle all encryption, key management, and decryption
• Permanent security: Once encrypted and stored, data remains secure forever

Encryption Options

1. Manual Client-Side Encryption

Encrypt your data before uploading with Turbo:

import CryptoJS from "crypto-js";

// Encrypt sensitive data
const data = "Sensitive information";
const secretKey = "your-secret-key";
const encryptedData = CryptoJS.AES.encrypt(data, secretKey).toString();

// Upload encrypted data
const result = await turbo.upload({
  data: encryptedData,
  dataItemOpts: {
    tags: [
      { name: "Content-Type", value: "application/octet-stream" },
      { name: "Encrypted", value: "true" },
      { name: "Cipher", value: "AES-256-GCM" },
      { name: "Cipher-IV", value: "YWJjZGVmZ2hpams=" }, // 12 byte initialization vector as Base64
    ],
  },
});

Encryption Standards

Encryption Methods

• AES-256-GCM: Authenticated encryption (recommended)
• AES-256-CTR: Stream cipher for large files
• Any encryption method: Arweave supports any encryption you choose (must be indicated in Cipher tag for ArFS compliance)

Required Tags

When uploading encrypted data, include these tags:

{
  name: "Content-Type",
  value: "application/octet-stream"  // Required for encrypted data
},
{
  name: "Cipher",
  value: "AES-256-GCM"  // Specify encryption method
},
{
  name: "Cipher-IV",
  value: "base64-encoded-iv"  // Initialization vector
}

ArFS Protocol (Optional Standardization)

The Arweave File System (ArFS) protocol provides optional standardization for encrypted storage:

• Private Drives: Encrypt entire file systems
• File-level encryption: Each file has its own encryption key
• Selective sharing: Share individual files without exposing the entire drive
• Key derivation: Uses HKDF-SHA256 with wallet signatures
• Completely optional: You can use any encryption method you prefer

Getting Started

Security Considerations

Best Practices:

• Use strong, randomly generated keys
• Implement proper key rotation
• Store keys securely (not in code)
• Use authenticated encryption (AES-GCM)
• Validate data integrity after decryption

Next Steps