Silentnox
Sign in Create project

Field encryption for production systems

Neither side holds
the whole secret.

Encrypt URLs, tokens, and PII fragments without handing one service everything required to decrypt them. Your application holds shard K. Silentnox holds shard S. Both are required.

Create a project Read the integration guide
  • No stored plaintext
  • AES-256-GCM
  • Keys shown once
YOUR APPLICATIONShard KEnvironment or secrets manager
K+SHKDF
SILENTNOXShard SWrapped platform shard
Runtime request
POST /api/v1/decrypt
{
  "blob": "snx_…",
  "key": "$SILENTNOX_PROJECT_KEY"
}

→ plaintext exists only in memory

Silentnox is a cryptographic service, not a secrets vault. Your keys and blobs remain in systems you control.

A narrow security boundary

Three steps from sensitive value to application memory.

  1. 01

    Create a project

    Generate a one-time project key and store it in your backend environment. Silentnox never shows it again.

    PROJECT_KEY
  2. 02

    Encrypt the field

    Turn a URL, token, or PII fragment into a self-contained authenticated blob stored in your database.

    snx_blob
  3. 03

    Decrypt at runtime

    Send both inputs from your backend. Use plaintext in memory, then discard it immediately.

    POST /api/v1/decrypt

Custody, made explicit

Who stores what?

Your application

Stores
Project key, encrypted blobs, business logic
Never needs to store
Field plaintext at rest

Silentnox

Stores
Wrapped platform shard, labels, audit metadata
Never stores
Your project key, blobs, or field plaintext
Inspect the complete security model →

Direct answers

Frequently asked questions

What is split-key field encryption?

A data-encryption key is derived from two independently held shards. Your application holds K and Silentnox holds S, so neither can decrypt alone.

Does Silentnox store plaintext or encrypted blobs?

No. Plaintext exists only while an encrypt or decrypt request is processed. Your system stores the resulting encrypted blob.

Is this a replacement for a KMS?

Not always. A KMS manages encryption keys broadly. Silentnox provides a narrower field-encryption workflow with split custody, application-ready blobs, and runtime APIs.

Can I call the decrypt API from a browser?

No. Call it only from your backend. Exposing the project key in browser code would break the intended security boundary.

Start with one field

Keep the value useful.
Remove the single point of trust.

Create a project →View API examples