Reversible Encryption
Unlike permanent anonymization, encrypted data can be fully restored to its original form. You hold the key, literally. cloak.business uses AES-256-GCM. Banks and governments rely on this same NIST-standard encryption worldwide.
Why Reversible Encryption?
Sometimes you need to protect data for a while. You don't need to destroy it forever.
Temporary Protection
Share documents with outside parties during a project. Restore the original data when the project ends.
Audit Compliance
Anonymize production data for testing. You still keep the ability to trace back to the originals for audits.
Legal Discovery
Protect sensitive information during legal proceedings. You still keep the ability to restore it if a court orders you to.
Safe AI Workflows
Send anonymized prompts to AI assistants. Restore the context later when you review the outputs yourself.
How It Works
1. Create Your Key
You create your own encryption key. It's a password of exactly 16, 24, or 32 characters. This key is never sent to or stored on our servers. You are the only one who knows it.
2. Encrypt & Share
Select the Encrypt method during anonymization. Each detected PII value becomes an encrypted token, like <encrypted:xyz123>. Share it freely. Without your key, the data cannot be recovered.
3. Decrypt with Same Key
Open the Deanonymizer. Paste the encrypted text. Enter the exact same key you used to encrypt. Click Decrypt. Your original values come back instantly.
Your Keys, Your Control
You create and protect your own encryption keys. We never store them.
You Create the Key
Choose a strong password of 16, 24, or 32 characters. This becomes your AES encryption key. We do not create keys for you.
Key Never Stored
Your key travels securely over HTTPS during encryption, then it's discarded right away. We never store your key on our servers.
Same Key Required to Decrypt
Decryption needs the exact key you used to encrypt. Even one wrong character makes decryption fail.
No Recovery If Lost
We cannot recover your data if you lose your key. Store it safely in a password manager. This is by design.
Anonymization Methods Compared
Encrypt is the only method that allows original data recovery with your key
| Method | Reversible | Readable | Linkable | Best For |
|---|---|---|---|---|
| encrypt | Temporary workflows, audits, legal | |||
| replace | Testing, demos, training data | |||
| redact | Legal documents, public records | |||
| hash | Research, analytics, pseudonymization | |||
| mask | Support, UI display |
Replace, Redact, Hash, and Mask all destroy the original data for good. Only Encrypt keeps your data recoverable. But you must safely store the key you created.
Real-World Use Cases
AI Assistant Workflows
Anonymize sensitive customer data before you send it to ChatGPT, Claude, or other AI assistants. Use the Chrome Extension or MCP Server to encrypt data on the fly. Restore the context later when you review AI outputs internally.
"Customer John Smith (john@company.com) reported..." → "Customer <encrypted:xyz> (<encrypted:abc>) reported..." → Original restored after AI processing
Vendor Data Sharing
Share project documents with outside consultants or vendors. Real names, emails, and other PII stay hidden. When the engagement ends, restore the originals for your internal records.
Share anonymized contracts during due diligence, restore originals for final signing
Production-to-Test Data
Copy production databases into test environments with encrypted PII. Developers work with realistic data structures. The real values stay protected the whole time. Restore specific records when you need to debug an issue.
Test with encrypted user data, decrypt specific records when investigating bugs
Legal Hold & Discovery
During litigation, anonymize documents you share with opposing counsel. If a court orders restoration, you can still decrypt the data. No evidence was destroyed.
Protect witness identities during discovery, restore if subpoenaed
Technical Specifications
AES-256-GCM encryption for enterprise trust
AES-256-GCM
This is the Advanced Encryption Standard. It uses 256-bit keys and Galois/Counter Mode for authenticated encryption. Banks, governments, and militaries worldwide use it.
Key Requirements
Keys are 16, 24, or 32 characters long (128, 192, or 256 bits). Longer keys give you stronger security.
Token Format
Encrypted values are stored as <encrypted:base64data> tokens. This makes them easy to spot and decrypt.
Zero Key Storage
Your encryption key is never stored on our servers. If you lose your key, encrypted data cannot be recovered. This is by design.
Available Everywhere
Use reversible encryption across every cloak.business platform. It works everywhere.
Web Application
Use the full encrypt and decrypt workflow in the Anonymizer and Deanonymizer tabs.
REST API
Call POST /api/presidio/anonymize with the encrypt operator. Then call POST /api/presidio/deanonymize to restore the data.
MCP Server
Use the text_anonymize and text_detokenize tools with Claude Desktop and other compatible AI assistants.
Desktop App
Process documents with the encrypt method. Key management stays synced with your vault.
Chrome Extension
Get one-click encryption for your ChatGPT, Claude.ai, and Gemini conversations.
Security Guarantees
- Your encryption key travels securely over HTTPS. We never store it on our servers
- Encrypted tokens cannot realistically be decrypted without the correct key
- We never store your encryption key. If you lose it, we cannot help you recover your data
- All processing happens on servers certified to ISO 27001, based in Falkenstein, Germany
- AES-256-GCM gives you both confidentiality and integrity checks
Multi-Party Encryption with Asymmetric Keys
Share encrypted data with outside apps and partners. You never share your decryption key.
External App Integration
External apps encrypt PII using your public key. Only you can decrypt it, using your private key. The decryption key never leaves your account.
Data Processing Pipelines
Set up pipelines to encrypt sensitive data automatically. Use the encrypt_asym operator with your public key ID.
Third-Party Audit Workflows
Share your public key with auditors. They encrypt their findings with it. Only you can read the results.
| Aspect | Symmetric (encrypt) | Asymmetric (encrypt_asym) |
|---|---|---|
| Keys | 1 shared key (16/24/32 chars) | RSA-4096 key pair (public + private) |
| Output size | ~88 chars/entity | ~730 chars/entity |
| Multi-party | Must share key | Only share public key |
| Token cost | Standard | Standard (same pricing) |
Frequently Asked Questions
What happens if I lose my encryption key?
Encrypted data becomes permanently unrecoverable. We do not store your key, so we have no way to decrypt your data. Always keep your encryption key in a secure password manager.
Can I use different keys for different documents?
Yes. Each anonymization operation uses the key you provide. You can use different keys for different projects. But you must track which key you used for which document.
What are the key requirements?
Keys must be exactly 16, 24, or 32 characters long (128, 192, or 256 bits). Longer keys give you stronger encryption. We recommend 32-character keys for the best security.
Can I decrypt only some values?
Right now, decryption processes all encrypted tokens in the text at once. You cannot decrypt just one value while leaving the rest encrypted.
Can I decrypt via API?
Yes. Call POST /api/presidio/deanonymize with the encrypted text and your key. The API sends back your fully restored original text.
Related Features
Explore other features that work well with reversible encryption.
All Anonymization Methods
Compare all 7 anonymization methods: Replace, Redact, Hash, Encrypt, Asymmetric Encrypt, Mask, and Keep. Pick the right one for your use case.
Zero-Knowledge Security
Your password never leaves your device. These are the same security principles that protect your encryption keys.
MCP Server Integration
Use reversible encryption directly in Claude Desktop, Cursor, and VS Code. Our MCP server makes this possible.
Is This Right For You?
Best For
- ✦Legal and HR workflows requiring re-identification of individuals for discovery or victim support
- ✦GDPR pseudonymization (Article 4(5)) and HIPAA pseudonymization compliance with controlled decryption keys
- ✦Audit trails and compliance reporting where reversible encryption proves data was anonymized but can be recovered
- ✦Secure data sharing with external parties where you control the decryption key and audit access logs
- ✦AES-256-GCM encryption with full key management and audit compliance across all platforms
Not For
- ✦Permanent GDPR anonymization requirements (reversibility means it's pseudonymization, not anonymization under GDPR)
- ✦Use cases where the encryption key must be shared broadly (increases key compromise risk and key management burden)