django-fernet-encrypted-fields 0.4.0

Django Fernet Encrypted Fields

This package was created as a successor to django-encrypted-fields.

Getting Started

$ pip install django-fernet-encrypted-fields

In your settings.py, set random SALT_KEY

SALT_KEY = '0123456789abcdefghijklmnopqrstuvwxyz'

Then, in models.py

from encrypted_fields.fields import EncryptedTextField

class MyModel(models.Model):
    text_field = EncryptedTextField()

Use your model as normal and your data will be encrypted in the database.

Rotating SALT keys

You can rotate salt keys by turning the SALT_KEY settings.py entry into a list. The first key will be used to encrypt all new data, and decryption of existing values will be attempted with all given keys in order. This is useful for key rotation: place a new key at the head of the list for use with all new or changed data, but existing values encrypted with old keys will still be accessible

SALT_KEY = [
    'zyxwvutsrqponmlkjihgfedcba9876543210',
    '0123456789abcdefghijklmnopqrstuvwxyz'
]

To generate a new SECRET_KEY, you can use Django's get_random_secret_key function.

from django.core.management.utils import get_random_secret_key

new_secret_key = get_random_secret_key()
print(new_secret_key)

Rotating SECRET_KEY

When you would want to rotate your SECRET_KEY, set the new value and put your old secret key value to SECRET_KEY_FALLBACKS list. That way the existing encrypted fields will still work, but when you re-save the field or create new record, it will be encrypted with the new secret key. (supported in Django >=4.1)

SECRET_KEY = "new-key"
SECRET_KEY_FALLBACKS = ["old-key"]

If you wish to update the existing encrypted records simply load and re-save the models to use the new key.

for obj in MyModel.objects.all():
    obj.save()

Available Fields

Currently built-in and unit-tested fields include the following. They have the same APIs as their non-encrypted counterparts.

• EncryptedCharField
• EncryptedTextField
• EncryptedDateTimeField
• EncryptedIntegerField
• EncryptedFloatField
• EncryptedEmailField
• EncryptedBooleanField
• EncryptedJSONField

Compatible Django Version

Contributing

See CONTRIBUTING.md for details on how to contribute to this project.