For fields you mark as Encrypt at field-config time, and for some of the platform's own internal storage of sensitive data (API tokens, third-party credentials), ActiveManage uses a configurable encryption engine. The choice of engine matters because each has different PHP requirements, performance characteristics, and security properties.
The three engine options
Site Settings → Security → Encryption Engine picks among:
openssl
Requires the openssl PHP extension (almost always available). Industry-standard, well-understood, supports a wide range of cyphers via the additional Encryption Cypher setting. Default for most installs because it's universally available and battle-tested.
sodium
Requires the sodium PHP extension (bundled with PHP 7.2+). Modern alternative with simpler key handling and resistance to common implementation mistakes that have bitten openssl users over the years. If you're on PHP 7.2 or above and don't have a specific reason to use openssl, sodium is the modern recommendation.
mcrypt
Deprecated as of PHP 7.1. Don't use it for new installs. Existing installs on this engine should plan a migration to one of the others before upgrading PHP, because mcrypt is being progressively removed from newer PHP versions.
Encryption Cypher (openssl only)
If you pick openssl, the platform exposes a Cypher setting that picks the underlying algorithm. The defaults are sensible — typically AES-256-CBC or AES-256-GCM — but you can override.
Sensible choices in 2025:
- AES-256-GCM — preferred when available. Authenticated encryption (protects against tampering as well as eavesdropping).
- AES-256-CBC — fine, slightly older but widely supported.
- Anything else — only pick if you have a specific reason. Stay with mainstream algorithms.
Algorithms to avoid: DES, 3DES (too weak), RC4 (broken), any ECB-mode cypher (vulnerable to chosen-plaintext attacks).
Encryption Level (sodium only)
For the sodium engine, the Encryption Level setting picks between four performance/strength trade-offs:
- php_l1 — very fast. Minimal iteration count. Suitable for high-volume environments where the values are not deeply sensitive.
- php_l2 — fast. Moderate iteration count. Sensible default for general use.
- php_l3 — slow. High iteration count. Significantly slower per operation but harder to brute-force. Use for the most sensitive values.
- am — ActiveManage standard (very fast). Platform-tuned default with a good balance.
Three real-world scenarios
Scenario 1: Standard business app on modern PHP
Engine: sodium. Level: am. Suitable for most installs running PHP 7.2 or later. Modern, fast, well-supported.
Scenario 2: Legacy hosting on older PHP
Engine: openssl. Cypher: AES-256-CBC. Works on any PHP version that has the openssl extension (basically all of them since PHP 5).
Scenario 3: High-security regulated app
Engine: sodium. Level: php_l3. Slower but stronger. Combine with longer field-level encrypted columns and audit-mode logging for every read.
Warning: Changing engines after launch requires re-encrypting every Encrypt-flagged value with the new engine. There's no live re-key feature — you'd need a custom migration script that reads each encrypted value, decrypts with the old engine, and re-encrypts with the new. Plan engine choice at install time and stick to it.