How to Create a File Encryption System Before Storage in FlutterFlow

Create an encrypted_files collection with fields: userId (Reference), fileName (String, original file name), storagePath (String, Firebase Storage path), salt (String, base64-encoded random salt used for key derivation), iv (String, base64-encoded initialization vector used for AES encryption), fileSize (Int, original file size in bytes), mimeType (String), uploadedAt (Timestamp), isEncrypted (Boolean, always true for this collection). The salt and IV are not secret — they are safe to store alongside the file reference. The security comes from the passphrase that only the user knows.

Create a Custom Action named encryptAndUploadFile with parameters: fileBytes (FFUploadedFile), passphrase (String), fileName (String). Add the encrypt and crypto packages as dependencies. In the action: generate a random 16-byte salt and a random 16-byte IV using SecureRandom. Derive the 256-bit AES key using PBKDF2 with HMAC-SHA256, 100000 iterations, the salt, and the passphrase. Create an AES Encrypter in CBC mode with the derived key. Encrypt the file bytes with the IV. Upload the encrypted bytes to Firebase Storage at encrypted/{userId}/{timestamp}_{fileName}. Create the Firestore encrypted_files doc with the salt, IV (both base64-encoded), storage path, and file metadata. Return success.

Create a Custom Action named decryptAndDownloadFile with parameters: encryptedFileDoc (Document Reference), passphrase (String). The action reads the Firestore doc to get the salt, IV, and storagePath. Downloads the encrypted bytes from Firebase Storage. Decodes the base64 salt and IV. Derives the same AES-256 key using PBKDF2 with the same salt and passphrase. Decrypts the ciphertext with AES-CBC using the key and IV. If decryption fails (wrong passphrase), the decrypt call throws — catch this and return an error message. On success, return the decrypted bytes for display or local file save.

Create a MyEncryptedFilesPage. Add an Upload FAB that opens a BottomSheet with a file picker (FlutterFlowUploadButton) and a TextField for the encryption passphrase (obscured). On Submit, call the encryptAndUploadFile Custom Action with the selected file and passphrase. Show a CircularProgressIndicator during upload. Below the FAB, display a ListView querying encrypted_files where userId equals the current user, ordered by uploadedAt desc. Each list item shows a Container card with a lock Icon, file name Text, file size Text, and upload date Text. Tapping a file opens a Dialog with a password TextField. On Submit, call decryptAndDownloadFile. Show the decrypted file or a download option on success.

Before encryption, validate the passphrase: minimum 8 characters, at least one uppercase letter, one number. Show a strength indicator (weak/medium/strong) below the passphrase field using Conditional Styling on a Container. For file sharing between users, implement a Cloud Function shareEncryptedFile(fileDocId, recipientUserId) that duplicates the encrypted_files metadata doc for the recipient. The recipient still needs the passphrase from the sender (shared out of band). Display shared files with a different icon (share icon instead of lock icon) and the sharer's name.