# Source: https://docs.hypermode.com/dgraph/self-managed/decrypt.md

# Data Decryption

<Info>
  We're overhauling Dgraph's docs to make them clearer and more approachable. If
  you notice any issues during this transition or have suggestions, please
  [let us know](https://github.com/hypermodeinc/docs/issues).
</Info>

You might need to decrypt data from an encrypted Dgraph cluster for a variety of
reasons, including:

* Migration of data from an encrypted cluster to a non-encrypted cluster
* Changing your data or schema by directly editing an RDF file or schema file

To support these scenarios, Dgraph includes a `decrypt` command that decrypts
encrypted RDF and schema files. To learn how to export RDF and schema files from
Dgraph, see [export database](/dgraph/admin/export).

The `decrypt` command supports a variety of symmetric key lengths, which
determine the AES cypher used for encryption and decryption, as follows:

| Symmetric key length | AES encryption cypher |
| -------------------- | --------------------- |
| 128 bits (16-bytes)  | AES-128               |
| 192 bits (24-bytes)  | AES-192               |
| 256 bits (32-bytes)  | AES-256               |

The `decrypt` command also supports the use of
[HashiCorp Vault](https://www.vaultproject.io/) to store secrets, including
support for Vault's
[AppRole authentication](https://developer.hashicorp.com/vault/docs/auth/approle).

## Decryption options

The following decryption options (or *flags*) are available for the `decrypt`
command:

| Flag or Superflag | Superflag Option | Notes                                                                                                     |
| ----------------- | ---------------- | --------------------------------------------------------------------------------------------------------- |
| `--encryption`    | `key-file`       | Encryption key filename                                                                                   |
| `-f`, `--file`    |                  | Path to file for the encrypted RDF or schema **.gz** file                                                 |
| `-h`, `--help`    |                  | Help for the decrypt command                                                                              |
| `-o`, `--out`     |                  | Path to file for the decrypted **.gz** file that decrypt creates                                          |
| `--vault`         | `addr`           | Vault server address, in **http\://\<*ip-address*>:\<*port*>** format (default: `http://localhost:8200` ) |
|                   | `enc-field`      | Name of the Vault server's key/value store field that holds the Base64 encryption key                     |
|                   | `enc-format`     | Vault server field format; can be `raw` or `base64` (default: `base64`)                                   |
|                   | `path`           | Vault server key/value store path (default: `secret/data/dgraph`)                                         |
|                   | `role-id-file`   | File containing the [Vault](https://www.vaultproject.io/) `role_id` used for AppRole authentication       |
|                   | `secret-id-file` | File containing the [Vault](https://www.vaultproject.io/) `secret_id` used for AppRole authentication     |

To learn more about the `--vault` superflag and its options that have replaced
the `--vault_*` options in release v20.11 and earlier, see
[Dgraph CLI Command Reference](/dgraph/cli/command-reference).

## Data decryption examples

For example, you could use the following command with an encrypted RDF file
(**encrypted.rdf.gz**) and an encryption key file (**enc\_key\_file**), to create
a decrypted RDF file:

```sh
# Encryption Key from the file path
dgraph decrypt --file "encrypted.rdf.gz" --out "decrypted_rdf.gz" --encryption key-file="enc-key-file"

# Encryption Key from HashiCorp Vault
dgraph decrypt --file "encrypted.rdf.gz" --out "decrypted_rdf.gz" \
  --vault addr="http://localhost:8200";enc-field="enc_key";enc-format="raw";path="secret/data/dgraph/alpha";role-id-file="./role_id";secret-id-file="./secret_id"
```

You can use similar syntax to create a decrypted schema file:

```sh
# Encryption Key from the file path
dgraph decrypt --file "encrypted.schema.gz" --out "decrypted_schema.gz" --encryption key-file="enc-key-file"

# Encryption Key from HashiCorp Vault
dgraph decrypt --file "encrypted.schema.gz" --out "decrypted_schema.gz" \
  --vault addr="http://localhost:8200";enc-field="enc_key";enc-format="raw";path="secret/data/dgraph/alpha";role-id-file="./role_id";secret-id-file="./secret_id"
```