--- schema_version: "1" id: 111879cea0ac5bb2728548027154474fa3bd162a0b0b8ca4b5273698a329ca2e title: EncryptSymmetric() collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/marketing-cloud/ampscript/references/encryption/mc-ampscript-reference-encryption-encrypt-symmetric.md canonical_url: https://developer.salesforce.com/docs/marketing/marketing-cloud-ampscript/references/mc-ampscript-encryption/mc-ampscript-reference-encryption-encrypt-symmetric.html source_site: developer.salesforce.com content_type: documentation content_hash: fb48b14abcd9c38b21eb76115e4af05e492baab9cfd7740e230eec5e1241d85f products: - AMPscript for Marketing Cloud - Marketing Cloud --- # EncryptSymmetric() Encrypts plain text data using the supplied algorithm and encryption values. You can supply either a value or a valid external key for the password, initialization vector (IV), and salt. You can also use the external keys if you previously created keys in the Key Management section of the Marketing Cloud Engagement web interface. If you haven't created any keys, the function generates a password using the password parameter or stored value, the salt parameter or stored value, and the IV parameter or stored value. If you don't pass or reference an initialization vector, the function uses the password parameter or stored value as the initialization vector. This function treats Salt and IV values either directly provided or looked up by key as hex strings, with each pair of characters representing a single byte in the larger strings. Don't attempt to use these values as a cipher string, because you can’t successfully decrypt those strings using this function. You can wrap the `EncryptSymmetric()` and `DecryptSymmetric()` functions in `Base64Encode()` and `Base64Decode()` functions to view the final string in plain text. You can only use the `EncryptSymmetric()` and `DecryptSymmetric()` AMPscript functions on data contained in Marketing Cloud Engagement. You can't use these functions with third-party encryption and decryption functionality. ## Availability
Marketing Cloud Engagement ✅ Yes
Marketing Cloud Next ❌ No
## Syntax ``` EncryptSymmetric(data, encryptionAlgorithm, passwordExternalKey, passwordValue, saltExternalKey, saltValue, ivExternalKey, ivValue) ``` The `EncryptSymmetric()` function has eight parameters: - `data` (string): Required. The plain text string to encrypt. - `encryptionAlgoritm` (string): Required. The algorithm to use to encrypt the data. See [Encryption Algorithm Options](#encryption-algorithm-options). - `passwordExternalKey` (string): Required. The external key of a password that was created in Key Management. - `passwordValue` (string): Required. The password value. - `saltExternalKey` (string): Required. The external key of a salt in Key Management. - `saltValue` (string): Required. The salt value, represented as an 8-byte hexadecimal string. - `ivExternalKey` (string): Required. The external key of an initialization vector in Key Management. - `ivValue` (string): Required. The initialization vector, represented as a 16-byte hexadecimal string. ## Encryption Algorithm Options To use this function, specify an encryption algorithm. Three algorithms are available. - `aes` — AES (Advanced Encryption Standard) - `des` — DES (Data Encryption Standard) - `tripledes` — Triple DES (applies the DES cipher to each data block three times) Of these options, AES is the most secure, followed by Triple DES, and then DES. When you use the DES or Triple DES algorithms, you can optionally specify a mode of operation. To specify a mode of operation, add a semicolon after the algorithm type, followed by `mode=` and the name of the cipher mode. Five cipher modes are available. - `cbc` - Cipher Block Chaining (default) - `cfb` - Cipher Feedback - `cts` - Ciphertext Stealing - `ecb` - Electronic Codebook - `ofb` - Output Feedback You can also include a padding method. To specify the padding method, add a semicolon after the mode of operation, followed by `padding=` and one of these options. - `ansix923` - ANSI X9.23 - `iso10126` - ISO 10126 - `none` - No padding - `pkcs7` - PKCS#7/RFC 5652 (this is the default padding method) - `zeros` - All bytes padded with zeros For example, to use Triple DES encryption with Cipher Feedback and ANSI X9.23 padding, specify `tripledes;mode=cfb;padding=ansix923` as the value of the second parameter. ## Usage This example sets the `@encData` variable to the encrypted value of the plain text supplied in the function (in this case, the word `Example`). This example uses provided values for the password, salt, and IV, and it sets any external key values to the undeclared variable `@null`. The Salt and IV values provided in this example represent hex string values. The Salt value includes 8 bytes of information, and the IV value provides 16 bytes. ``` %%[ Set @encData=EncryptSymmetric('Example', /* String to encrypt */ 'aes', /* Encryption algorithm */ @null, /* Password external key */ 'password', /* Password */ @null, /* Salt external key */ '0000000000000000', /* Salt value */ @null, /* IV external key */ '00000000000000000000000000000000' /* External key value */) ]%% ``` This example generates an encrypted string using Triple DES encryption with Cipher Feedback and ANSI X9.23 padding. ``` %%[ Var @encData, @string, @password, @salt, @iv Set @string = "Example" Set @password = "password" Set @salt="20192027EEBF11C8" Set @iv = "1493786BAE6088BA1EF0B505B4EF9852" Set @encData = EncryptSymmetric(@string, "tripledes;mode=cfb;padding=ansix923", @null, @password, @null, @salt, @null, @iv) ]%% %%=v(@encData)=%% ``` The function outputs the encrypted string. ``` 6eCZjiaICrQ= ``` ## See Also - [DecryptSymmetric()](https://developer.salesforce.com/docs/marketing/marketing-cloud-ampscript/references/mc-ampscript-encryption/mc-ampscript-reference-encryption-decrypt-symmetric.md) - _Salesforce Help_: [Key Management in Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_key_management.htm)