Custom Salesforce Field Encryption with Apex -

In Salesforce, securing sensitive information like passwords is crucial, especially when custom encryption and decryption methods are required. While Salesforce offers native encryption options, you may sometimes need a custom solution to meet specific business needs. In this article, I’ll share how I implemented a custom approach to encrypt and decrypt a password field in Salesforce using Apex.

Why Choose Custom Encryption and Decryption?

Salesforce Shield Platform Encryption may not always fulfill all requirements, particularly when you need to decrypt data in Apex for programmatic use. Additionally, storing the encryption key separately for each record enhances security. To address these needs, I used two custom fields:

Password: Stores the encrypted version of the user’s password.
Password Key: Holds the encryption key, which allows decryption when needed

Step-by-Step Guide to Encrypting and Decrypting Password Fields

1. Setting Up the Fields

Start by creating two fields in the same object where you’ll store the encrypted data:

Password (Text field): Stores the encrypted version of the password the user enters.
Password Key (Text field): Holds the unique encryption key that is generated each time a password is provided.

2. Creating a Trigger for Encrypting the Password

Next, you’ll create a trigger on the same object where the record is inserted. This trigger handles the encryption process. Specifically, it generates an encryption key, stores it in the Password Key field, and encrypts the Password field before saving the record.

Here’s the Apex code for the trigger:

trigger EncryptPassword on YourObject__c (before insert) {
    for (YourObject__c record : Trigger.new) {
        if (String.isNotBlank(record.Password__c)) {
            // Generate encryption key
            Blob cryptoKey = Crypto.generateAesKey(256);
            record.Password_Key__c = EncodingUtil.base64Encode(cryptoKey);
            
            // Encrypt the password field
            Blob passwordBlob = Blob.valueOf(record.Password__c);
            Blob encryptedPassword = Crypto.encryptWithManagedIV('AES256',    cryptoKey, passwordBlob);
            record.Password__c = EncodingUtil.base64Encode(encryptedPassword);
        }
    }
}

This trigger performs the following actions:

First, it checks if the user has provided a password.
It then generates a 256-bit AES encryption key and stores it in the Password Key field.
Finally, it encrypts the password and saves the encrypted value in the Password field.

3. Decrypting the Password in Apex

To retrieve and use the password, you’ll need to decrypt it using the key stored in the Password Key field. Below is an Apex method that handles decryption:

public class PasswordUtil {
    public static String decryptPassword(YourObject__c record) {
        if (String.isNotBlank(record.Password__c) && String.isNotBlank(record.Password_Key__c)) {
            // Retrieve the encryption key
            Blob cryptoKey = EncodingUtil.base64Decode(record.Password_Key__c);
            
            // Decrypt the password
            Blob encryptedPassword = EncodingUtil.base64Decode(record.Password__c);
            Blob decryptedPassword = Crypto.decryptWithManagedIV('AES256', cryptoKey, encryptedPassword);
            return decryptedPassword.toString();
        }
        return null;
    }
}

In this method:

First, the encryption key and encrypted password are decoded.
Then, using the encryption key, the system decrypts the password and returns it as plain text.

Why Use Separate Fields for Password and Password Key?

Storing the encryption key in a separate field enhances security. Even if someone gains access to the encrypted password, they won’t be able to decrypt it without the key stored in the Password Key field. This approach keeps your data secure while still allowing decryption in Apex when necessary.

Advantages of Custom Encryption in Salesforce

There are several benefits to using custom encryption:

Control: You have full control over the encryption and decryption processes.
Security: Storing the encryption key separately ensures additional protection for sensitive data.
Apex Integration: Decryption within Apex allows secure processing within Salesforce workflows.

Conclusion

Custom encryption in Salesforce provides both flexibility and enhanced security, especially when dealing with sensitive data like passwords. By utilizing two fields—one for the encrypted password and another for the encryption key—you ensure that your data remains secure while still allowing it to be decrypted when necessary. Moreover, this solution offers more control than Salesforce’s native encryption. Therefore, it becomes a great option for handling sensitive information in custom applications

Custom Salesforce Field Encryption with Apex

Table of Contents