OpenClaw Backend Data Encryption

Problem It Solves

OpenClaw agents may need to store keys, session state, or sensitive metadata when running in Node.js/backend, CLI, or background environments. backend-encryption targets this by using the Node.js crypto module instead of browser-side Web Crypto, with a local, offline, layered key model.

How It Works

• Master key: derived from a passphrase with crypto.pbkdf2; a persisted Salt lets the same passphrase recover the same Master Key after reboot.
• Key wrapping: a random KEK is encrypted by the MK; scoped DEKs are protected by the KEK, avoiding cleartext key storage.
• Algorithm and network: keys are wrapped with AES-256-GCM; no external network requests are made.
• Isolation: storage keys follow ${userId}:${channelId}:key, separating users and channels in concurrent backends.

Boundaries

This skill is Local Manual Mode, suitable for CLIs, background tasks, or server-side agents, not for automatic re-login, remote decryption, or cross-machine passphrase-free recovery. After reboot, a passphrase is required to unlock. If underlying storage leaks, keys for different users remain structurally separated, but config files, passphrase, and storage permissions still need protection.