In a web app, it's common practice to encrypt sensitive information against a user's password. In this scenario, what's how would you access/encrypt/decrypt that information using token based authentication?

If a user logs into the web app using their username/pw, which gives them access to their sensitive information, how do you create a token (say, for API access), to access/encrypt/decrypt that same information?

  • 1
    Encryption is used to ensure the confidentiality of data from someone who could have access to this data without being authorized. In your case, who could have access to user data without authorization ? If it's data in transit between the browser and the server, just use TLS. Otherwise, you will need to explain a bit more your use-case so that we can give you a meaningful answer.
    – A. Hersean
    Commented Apr 15, 2019 at 14:47
  • Do you need to store the information if it is only accessible to the user? If it's encrypted with the users password, you will not have access to it.
    – vidarlo
    Commented Apr 15, 2019 at 15:13
  • if server can't have key, then the client doesn't need to base anything on password/token/authentication... all encryption/decryption would be done client-side. So the server only sends/receives that sensitive info encrypted. (gobble-dee-gook to the server...) Your password/token/authentication only gives you access to encrypted data. Commented Sep 3, 2021 at 19:06

1 Answer 1


I think this question is actually three questions.

Username/password authenticates the user to the application. This establishes a user identity. If you then issue them an API token, this authorizes them to use particular API functionality. Encryption should be completely decoupled from these other actions and handled entirely server-side. An example flow:

User A logs in to example.com. As part of the authentication flow, they are issued a signed bearer token that contains their user identifier and their permission set (standard user). This user wants to view a private document in their account. Their browser makes an API request and passes the bearer token (plus a CSRF token, etc) with the request. The API then validates the permission set on the token and the user identifier's access to the resource. If the authorization check succeeds, the server retrieves the appropriate encryption key (from a secure store) for the resource, decrypts it, and returns it to the user.

  • There are some web apps that require client-side encryption (password managers, end-to-end encrypted messengers, very secure data storage, etc.). It's not common but it is more secure than server-side encryption, since the server doesn't have the keys and thus simply can't decrypt the user data even if the server is totally compromised / has a malicious admin... At least, not without sending malicious script to the user to steal their key when they log in, which is kind of a major issue for this type of security in web apps.
    – CBHacking
    Commented May 7, 2021 at 11:17

You must log in to answer this question.