Encryption for Arweave Uploads

Encrypt files with AES-256-GCM before they reach Arweave, store IV and auth tag safely, and keep decryption keys outside Evercore.

AES-256-GCM applied server-side before data reaches Arweave. Keys are derived per file — never persisted. Even if the permaweb were fully public, your data remains opaque.

Permanent retention without permanent plaintext exposure.

Encryption makes Arweave viable for regulated records, customer content, and internal evidence chains that cannot be written to public infrastructure in the clear.

Value

Protect data before it leaves your boundary

Evercore encrypts before storage so the permanent artifact is ciphertext, not raw business content.

Support stricter customer reviews

Security and compliance teams get a clearer story around confidentiality, metadata handling, and separation of sensitive payloads.

Use one storage contract for public and private assets

Teams can serve public manifests and retain protected records without maintaining two unrelated storage stacks.

How it works

Client sends plaintext payload

Your application sends the raw file over HTTPS. No client-side crypto library needed.

Server derives unique key

PBKDF2 with a per-file salt generates a fresh 256-bit key. Keys are derived — never stored.

AES-256-GCM encryption applied

Authenticated encryption with additional data (AEAD). The auth tag ensures tamper detection on download.

Ciphertext uploaded to Arweave

Only ciphertext reaches the network. Salt and IV are prepended — needed for decryption, useless without your key.

Use cases

Healthcare Records

HIPAA-grade PHI storage. Patient records encrypted before upload ensure clinical data is opaque on the public permaweb.

Legal & Financial Docs

Contracts, audit trails, and trade records that must be permanent but confidential. Ciphertext on Arweave, keys held by your team.

Media & IP Protection

Encrypt creative assets before upload. Distribute decryption access selectively without relying on gateway-level access controls.

Security guarantees

Authenticated Encryption

GCM mode provides both confidentiality and data integrity. Any tampering with the ciphertext is detected on decryption.

Forward Secrecy by Design

Per-file salts ensure that compromising one file's derived key reveals nothing about any other file's key.

Zero Server-Side Key Storage

Keys are derived at runtime from your API credentials. No key database, no HSM dependency, no key rotation complexity.

For operators

  • Apply encryption inside the upload flow instead of bolting on a second processing pipeline.
  • Combine with Business Profiles to split searchable metadata from sensitive payload context.
  • Keep versioning and traceability intact while still protecting the underlying file body.

For buyers

  • Makes permanent storage easier to approve in legal, healthcare, and finance workflows.
  • Reduces the need to explain custom crypto wrappers around object storage and blockchain writes.
  • Creates a stronger enterprise position for customers that care about chain of custody and confidentiality together.

Does my client need a crypto library?

No. Encryption is applied server-side by Evercore before the payload reaches Arweave. Your client sends plaintext over HTTPS — the same as any REST API call.

Can I decrypt a file without Evercore?

Yes. The salt and IV are prepended to the ciphertext on Arweave. Any AES-256-GCM implementation can decrypt the data given your API secret — no vendor lock-in.

What happens if I rotate my API key?

Files encrypted with an old key remain decryptable as long as you retain that key. New uploads use the new key. There is no automatic re-encryption — plan key rotation deliberately.