← All tools
Public-key
Envelope encryption & key wrapping
Generate a real KMS-style KEK, wrap a fresh DEK with it via RSA-OAEP, encrypt data locally, then unwrap and decrypt — plus a second panel wrapping a key with real AES Key Wrap (RFC 3394).
What's happening under the hood →·Read the Symmetric-key cryptography & AES module for the full explanation →·See the Envelope encryption: how a KMS actually protects your data use case →·See the Key wrapping and key exchange: moving keys without ever exposing them use case →
1. Generate a KEK and a DEK
A real RSA-OAEP key pair standing in for a KMS master key, and a real AES-256 key standing in for a per-object data key.