Even within a given engine you choose a cipher — the algorithm and mode that does the actual encrypting. Choosing the right cipher matters for security, performance and compatibility.
Recommended Ciphers
- XChaCha20-Poly1305 (Sodium): Fast on all hardware (no AES-NI required), authenticated, 24-byte nonce reduces nonce-reuse risk.
- AES-256-GCM: Hardware-accelerated on modern CPUs, widely interoperable, 256-bit security level.
- AES-128-GCM: Slightly faster, 128-bit security level — fine for most use cases but choose 256 if you're encrypting data with a long lifetime.
Avoid
- AES-CBC without HMAC: Not authenticated; vulnerable to padding-oracle attacks. Acceptable only when paired with HMAC.
- AES-ECB: Reveals patterns in encrypted data. Never use.
- DES, 3DES, RC4: Cryptographically broken. The platform refuses these by default.
Use-Case Recommendations
- Database column encryption: XChaCha20-Poly1305 or AES-256-GCM.
- File-at-rest encryption: AES-256-GCM (hardware acceleration matters for large blobs).
- API token signing: Ed25519 (not encryption per se, but the signature scheme of choice).
- JWT signing: EdDSA over Ed25519, falling back to RS256 only when required by a third party.
Worked Examples
- Encrypting customer email addresses in the DB: XChaCha20-Poly1305 — fast, authenticated, no hardware dependency.
- Encrypting uploaded scans/IDs: AES-256-GCM — multi-megabyte files benefit from hardware AES.
- Long-term archive encryption (10+ years): AES-256-GCM — gives a comfortable margin against future advances.