Choosing a Cipher
The Encryption Cypher setting chooses the algorithm and mode used to encrypt field data. It applies only when the engine is OpenSSL.
Where to find it
Architect Panel → Configuration:
- Site Settings — Encryption Cypher — applies only with the OpenSSL engine
The default
It ships at AES-256 in CBC mode. That is a well-understood, widely reviewed choice, and it is the right answer for essentially every installation.
Why you probably should not change it
Cipher selection is one of those settings where the available options are not equally good, and the difference is not visible from the setting name. A shorter key length, an outdated algorithm or an inappropriate mode all look like ordinary choices in a list.
Unless you are working to a specific standard that names a different cipher, leave it. There is no performance problem to solve here — field encryption is not where a well-built application spends its time.
If you must change it
Change it before any data is encrypted. Data encrypted under one cipher is not readable under another, so changing it on a system holding encrypted fields means a planned decrypt-and-re-encrypt migration.
Confirm the cipher you choose is supported by the OpenSSL build on every server, and prefer a 256-bit key and an authenticated or well-established mode.
It does nothing under Sodium
If your engine is Sodium, this setting is ignored entirely — the equivalent control is Encryption Level. Changing the cipher while running Sodium produces no change and no warning, which has confused people into thinking encryption was not working.
Record what you chose
Note the engine and cipher in your system documentation. It is the first thing anybody needs when restoring a backup onto a rebuilt server, and it is otherwise only discoverable from a settings screen you may not be able to reach.
The key matters more than the cipher
Any modern cipher is strong enough. Whether the encryption is meaningful depends on where the key lives and who can reach it — a strong cipher with a key sitting beside the data in the same backup protects against very little.
Spend your attention on key handling and backup separation rather than on the algorithm choice.
Worked example
An organisation reviews its configuration before go-live, confirms the engine is OpenSSL and the cipher is the AES-256 default, checks the extension is present on both servers, and records both in the runbook. Nothing is changed — which is the correct outcome of that review.
Recommendations
- Keep the default unless a standard requires otherwise.
- Change it only before encrypting data, never after.
- Ignore it entirely under Sodium.
- Record engine and cipher in your runbook.