Skip to main content
In this guide, you’ll learn how to enable and use the Transit Secrets Engine in HashiCorp Vault for secure data encryption workflows. We’ll cover:
  • Enabling the engine
  • Creating and managing encryption keys
  • Encrypting and decrypting data
  • Rotating keys and setting decryption constraints
  • Rewrapping ciphertext to the latest key version

​
Prerequisites

Make sure you have:
  • Vault CLI installed and authenticated (VAULT_ADDR & token configured).
  • A running Vault server (Dev mode or Production).

​
1. Enable the Transit Secrets Engine

By default, the Transit engine mounts at transit/. To enable it:
To use a custom path, append -path:

​
2. Create an Encryption Key

Every Transit operation requires a named key. Create vault_training:
To specify a key type (e.g., RSA-4096):

​
Supported Key Types

​
3. Encrypt Data

Vault expects Base64-encoded plaintext. Encrypt the string Getting Started with HashiCorp Vault:
Response:
  • ciphertext: Encrypted data with key version prefix (vault:v1:)
  • key_version: Version of the key used
You can use base64 -d to decode any Base64 output from Vault.

​
4. Decrypt Data

Pass the ciphertext back to Vault to decrypt:
Response:
Decode to reveal the original message:

​
5. Rotate Encryption Keys

Regular key rotation enhances security. To rotate vault_training:
Inspect all key versions:

​
6. Configure Minimum Decryption Version

To prevent decryption with older keys, set min_decryption_version:
Reading the key:
The image is a slide titled "Working with Encryption Keys" discussing key configuration, specifically about limiting the version of keys used for decrypting data. It mentions configuring the minimum key version for each encryption key.
Any ciphertext with versions below 4 will be rejected.
After raising min_decryption_version, older ciphertext cannot be decrypted. Plan rotations accordingly.

​
7. Rewrap Ciphertext

Rewrapping updates existing ciphertext to the newest key version without exposing plaintext:
Response:
Vault decrypts with version 1 internally and re-encrypts with version 4.
Rewrap is ideal when you need to enforce new key policies on legacy data.

Watch Video