This is my page and class to encrypt the string entered and saved in database. Each time, the Key__c is the same, as I take it from custom settings. But when I enter abc and save two times, the entered value is different. What is the reason?

<apex:page controller="encryptNewController">
    <apex:form >   
         <apex:outPutLabel value="Encrypted by Code"/>
         <apex:inputsecret value="{!encryptedByCode}"/>

         <apex:commandButton value="Save" action="{!saveValues}"/>
         <apex:outputText value="{!decryptedDataString}"/>

public with sharing class encryptNewController {

     Public Encrypt_Object__c encryptObject {get;set;}
     Public String encryptedByCode {get;set;}
     Public String decryptedDataString {get;set;}
     Blob cryptoKey;
     public encryptNewController(){
          encryptObject=new Encrypt_Object__c();
     public void saveValues(){
            List<CryptoKey__c> keyValue = [SELECT  Key__c FROM CryptoKey__c where id != null];
                String cryptoKeyString;
                if(keyValue.size() > 0){
                    cryptoKeyString = keyValue[0].Key__c;
                    cryptoKey = EncodingUtil.base64Decode(cryptoKeyString);
            encryptObject.Encrypted_by_Code__c = encryptToken(encryptedByCode);

            insert encryptObject;
            Encrypt_Object__c insertedencryptObject = [Select id,Encrypted_by_Code__c from Encrypt_Object__c where id=: encryptObject.id][0];
            decryptedDataString =decryptToken(insertedencryptObject.Encrypted_by_Code__c);            

     public String encryptToken(String strOriginal){
        Blob encryptedData;
        if(cryptoKey != null){
            String strUrlUTF8 = EncodingUtil.urlEncode(strOriginal, 'UTF-8');
            Blob b = Blob.valueOf(strUrlUTF8);
            encryptedData = Crypto.encryptWithManagedIV('AES256', cryptoKey, b);
            return  EncodingUtil.base64Encode(encryptedData);
            return null;


      public String decryptToken(String encryptedString){
        if(cryptoKey != null){
         Blob b = EncodingUtil.base64Decode(encryptedString);
         Blob decryptedData = Crypto.decryptWithManagedIV('AES256', cryptoKey, b);
         String strUrlUTF8 = decryptedData.toString();
         return EncodingUtil.urlDecode(strUrlUTF8, 'UTF-8');
            return null;

Doesn't the same string encrypted with the same key generate the same encrypted value?


Most encryption schemes are designed so that encrypting the same value twice generates different encrypted values. This is a security property.

Encryption schemes such that encrypting the same value twice results in the same ciphertext are said to be deterministic. Deterministic encryption is necessary in some applications, but should be avoided by default.

Consider the following scenario: a server is willing to let me upload documents and encrypt them, but not to let me decrypt documents. Let's say I want to know the contents of someone else's document. I make some guesses and submit them to the server, to I get the ciphertext corresponding to my guesses. If the encryption scheme is determininstic, then I can compare the ciphertexts for my guesses against the ciphertext for the confidential document. With an encryption scheme that includes a random element, even if my guess is correct, the ciphertext will be different — thus a randomized encryption scheme can provide semantic security, but a deterministic scheme cannot.

Most symmetric encryption schemes include an initialization vector (IV) or other element that is different (often random, but the requirements vary depending on the algorithm) each time an encryption is performed. Many asymmetric encryption scheme include random padding for the same effect.

So it's normal that encrypting the same value twice produces different result. Indeed, unless you've established a need for deterministic encryption, getting the same value twice would be a sign that something is wrong. If you're testing your application, you can't test the ciphertext against a known value, you need to decrypt it independently.


It appears that encryptWithManagedIV () generates random IV each time you use it. Thus, different ciphertexts (which is good BTW). See here:

Use the encryptWithManagedIV() function to have Salesforce generate the IV for you in the first 16 bytes of the cipher text.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.