Skip to main content
MainWP version 4.5 introduced an enhanced encryption system for storing third-party API keys and login details. This encryption follows industry security standards to protect sensitive data stored in your MainWP Dashboard.

​
What You’ll Learn

  • How MainWP encrypts API keys and credentials
  • What the encryption process involves
  • What data is and isn’t covered by this encryption

​
Scope of Encryption

MainWP encrypts sensitive data stored in the Dashboard:
This encryption applies to data stored in the MainWP Dashboard. It does not cover data created by third-party plugins on child sites. For example, MainWP encrypts the API key used by a backup extension, but does not encrypt the backup files created on child sites.

​
Encryption Components

The encryption process uses these security measures:

​
What is AES GCM

AES GCM (Galois Counter Mode) is a stream cipher mode for AES encryption. Key characteristics:
  • Low latency: Fast encryption and decryption
  • No padding required: Stream cipher design
  • Authenticated encryption (AEAD): Verifies data hasn’t been tampered with
  • Authentication tag: Each encryption produces a MAC (Message Authentication Code)
With AES-GCM, MainWP uses an encryption key and message to generate cipher text, a random nonce, and an authentication tag.

​
Encryption Workflow

The encryption process follows these steps: MainWP API Key encryption diagram

​
Security Benefits

This design provides multiple layers of protection:
  • Separation: Encryption key stored separately from encrypted data
  • Integrity: Authentication tag detects tampering
  • Uniqueness: Random IV ensures identical values produce different ciphertexts
  • Industry standard: AES-256 GCM is widely trusted for secure data storage