lockbox
A modern encryption library for Ruby and Rails that works with database fields, files, and strings.
What is lockbox?
Lockbox is a modern encryption library for Ruby and Rails that provides application-level encryption for database fields, files, and strings. It solves the problem of securing sensitive data in Ruby applications by offering seamless integration with popular ORMs and file upload libraries, ensuring data is encrypted at rest without disrupting existing workflows.
Ruby and Rails developers who need to encrypt sensitive data like emails, files, or user information in their applications, particularly those using Active Record, Active Storage, or other supported libraries.
Developers choose Lockbox for its zero-dependency design, ease of migration from existing data, and comprehensive support for key rotation and multiple encryption algorithms. Its focus on compatibility with existing code and libraries reduces the friction of adding encryption to Rails applications.
Overview
Modern encryption for Ruby and Rails
Use Cases
Best For
- Encrypting sensitive database columns like emails or phone numbers in Rails applications
- Securing file uploads in Active Storage, CarrierWave, or Shrine with encryption
- Migrating existing unencrypted data to encrypted columns without downtime
- Implementing key rotation for encryption keys in production environments
- Adding encryption to Action Text rich text content in Rails
- Using hybrid cryptography to allow servers to encrypt data without decryption capabilities
Not Ideal For
- Systems requiring full-disk or database-level encryption, as Lockbox operates at the application layer only
- High-performance applications where encryption overhead could bottleneck real-time data processing
- Projects needing seamless support for Active Storage variants and previews with encrypted files
- Environments mandating FIPS-certified cryptographic algorithms not provided by default
Pros & Cons
Pros
Lockbox has no external dependencies by default, keeping it lightweight and easy to integrate, though optional Libsodium support is available for advanced features like XSalsa20.
It provides built-in tools for encrypting existing data without downtime and rotating keys, with clear examples for Active Record and file uploaders in the README.
Lockbox seamlessly works with Active Record, Active Storage, CarrierWave, Shrine, and others, supporting serialized fields and types for maximum compatibility.
Defaults to AES-GCM with 256-bit keys, and offers advanced options like XSalsa20 and hybrid cryptography, with detailed setup instructions for each.
Cons
When encrypting Active Storage files, variants and previews aren't supported, and metadata extraction is disabled, impacting user experience for media-heavy apps.
Using XSalsa20 or hybrid cryptography requires installing Libsodium separately, adding platform-specific setup complexity and potential maintenance overhead.
Encrypted fields cannot be queried directly; developers must integrate the separate Blind Index gem for search functionality, adding another dependency.
Encryption and decryption add computational cost, which might be significant for applications handling high volumes of data or frequent file operations.
Frequently Asked Questions
Related Projects
deviseFlexible authentication solution for Rails with Warden.
spreeOpen-source headless eCommerce platform with REST API, TypeScript SDK, and Next.js storefront for cross-border, B2B or marketplace eCommerce.
activeadminThe administration framework for Ruby on Rails applications.
CarrierwaveClassier solution for file uploads for Rails, Sinatra and other Ruby web frameworks
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.