# Field encryption

> Encrypts app table columns and custom field values at rest with a data key per tenant, user or app, kept in Supabase Vault as bs:field-key:<owner>. Only security definer read paths that check the caller's scope decrypt; drop_field_key deletes a key so its values can no longer be read.

- Category: Database primitives
- Module: `field-encryption`
- Modes: `managed`
- Docs: https://bettersupabase.com/docs/blocks/field-encryption
- Page: https://bettersupabase.com/blocks/field-encryption

## Install

```bash
npx better-supabase add field-encryption
```

## Configure

Add the block to `better-supabase.config.ts`:

```ts
import { defineConfig } from "better-supabase/config";

export default defineConfig({
  blocks: {
    // Modes: "managed". The default is "managed".
    "field-encryption": { mode: "managed" },
  },
});
```

## Client

The block is SQL only: call its functions from your policies, RPCs and the other modules.

## Events

- `field_key.dropped`