How to Implement a Custom Encryption System for Data Security in FlutterFlow

In FlutterFlow, go to Settings → Pubspec Dependencies and add encrypt: ^5.0.3 and pointycastle: ^3.7.4. The encrypt package provides a high-level AES API. The pointycastle package provides the underlying cryptographic primitives including PBKDF2 for key derivation. Create a Custom Action called encryptField that accepts plaintext (String) and encryptionKey (String) as parameters and returns an encrypted Base64 string. Inside the action, convert the 32-character key string to a Key object using Key.fromUtf8(keyString.padRight(32).substring(0, 32)), generate a random IV using IV.fromSecureRandom(16), and encrypt using Encrypter(AES(key, mode: AESMode.cbc)).encrypt(plaintext, iv: iv). Return the IV appended to the ciphertext as a single Base64 string for storage.

1// Custom Action: encryptField
2// Parameters: plaintext (String), keyString (String)
3// Returns: String (base64 encoded IV + ciphertext)
4import 'package:encrypt/encrypt.dart' as enc;
5
6Future<String> encryptField(String plaintext, String keyString) async {
7  // Key must be exactly 32 bytes for AES-256
8  final keyBytes = keyString.padRight(32).substring(0, 32);
9  final key = enc.Key.fromUtf8(keyBytes);
10  final iv = enc.IV.fromSecureRandom(16);
11  final encrypter = enc.Encrypter(enc.AES(key, mode: enc.AESMode.cbc));
12  final encrypted = encrypter.encrypt(plaintext, iv: iv);
13  // Combine IV + ciphertext for storage
14  final combined = iv.base64 + ':' + encrypted.base64;
15  return combined;
16}
17
18// Custom Action: decryptField
19// Parameters: ciphertext (String), keyString (String)
20// Returns: String (original plaintext)
21Future<String> decryptField(String ciphertext, String keyString) async {
22  final parts = ciphertext.split(':');
23  if (parts.length != 2) return '';
24  final keyBytes = keyString.padRight(32).substring(0, 32);
25  final key = enc.Key.fromUtf8(keyBytes);
26  final iv = enc.IV.fromBase64(parts[0]);
27  final encrypter = enc.Encrypter(enc.AES(key, mode: enc.AESMode.cbc));
28  return encrypter.decrypt64(parts[1], iv: iv);
29}

A hardcoded key string in your Custom Action code is the most dangerous encryption pattern. It means everyone who has your app's source code (or decompiles the binary) has your encryption key. Instead, derive the key from the user's password using PBKDF2 (Password-Based Key Derivation Function 2). PBKDF2 takes a password, a random salt, and an iteration count (minimum 100,000 for security), and produces a fixed-length key. Store the salt in the user's Firestore document (it does not need to be secret). Derive the key each session after the user logs in, store it only in memory as an App State variable (not persisted), and discard it when the user logs out. This means only someone who knows the password can derive the correct key.

1// Custom Action: deriveKey
2// Parameters: password (String), saltBase64 (String)
3// Returns: String (hex key for use in encrypt/decrypt actions)
4import 'package:pointycastle/export.dart';
5import 'dart:convert';
6import 'dart:typed_data';
7
8Future<String> deriveKey(String password, String saltBase64) async {
9  final salt = base64.decode(saltBase64);
10  final passwordBytes = utf8.encode(password);
11
12  final params = Pbkdf2Parameters(
13    Uint8List.fromList(salt),
14    100000, // iterations
15    32,     // output key length in bytes (256 bits)
16  );
17
18  final pbkdf2 = PBKDF2KeyDerivator(HMac(SHA256Digest(), 64));
19  pbkdf2.init(params);
20
21  final key = pbkdf2.process(Uint8List.fromList(passwordBytes));
22  return base64.encode(key);
23}

Encrypted fields are stored as Base64 strings in Firestore. The string looks like two Base64 values separated by a colon: the IV and the ciphertext. In FlutterFlow, when writing a sensitive field (such as a medical note or private message), call encryptField in your Action Flow before the Firestore Create Document action, passing the plaintext and the derived key from App State. Bind the Firestore field to the return value of encryptField. When reading the field, call decryptField with the stored ciphertext and the in-memory derived key, and bind the result to your UI widget instead of the raw Firestore value. Never display the raw Base64 ciphertext string directly in the UI.

For applications that require regulatory compliance (HIPAA, GDPR for medical data), the client-derived key approach has a limitation: if a user forgets their password, their data is unrecoverable. Google Cloud KMS (Key Management Service) stores encryption keys in a hardware security module (HSM) and provides an API to encrypt and decrypt data server-side. In this pattern, your Cloud Function calls KMS to encrypt sensitive data before writing it to Firestore, and calls KMS again to decrypt on read. The KMS key never leaves the HSM. Access to the KMS key is controlled by Google IAM roles, providing a full audit trail. Set up KMS in the Google Cloud console: create a Key Ring, create an AES-256 key, and give your Cloud Function's service account the Cloud KMS Crypto Key Encrypter/Decrypter role.

1// Cloud Function: encryptSensitiveData
2// Uses Google Cloud KMS for server-side encryption
3const { KeyManagementServiceClient } = require('@google-cloud/kms');
4const functions = require('firebase-functions');
5
6const kmsClient = new KeyManagementServiceClient();
7const keyName = 'projects/YOUR_PROJECT/locations/global/keyRings/YOUR_RING/cryptoKeys/YOUR_KEY';
8
9exports.encryptSensitiveData = functions.https.onCall(async (data, context) => {
10  if (!context.auth) throw new functions.https.HttpsError('unauthenticated', 'Must be logged in');
11  const plaintext = Buffer.from(data.plaintext, 'utf8');
12  const [result] = await kmsClient.encrypt({ name: keyName, plaintext });
13  return { ciphertext: result.ciphertext.toString('base64') };
14});