Database encryption

SQLite can work with encrypted databases, but the official SQLite client library doesn’t include database encryption by default. Encryption and decryption are usually provided by custom SQLite builds that include encryption extensions. These extensions handle encryption at the engine level during read and write operations, so applications can work with the database without code changes.

Devart ODBC Driver for SQLite provides built-in encryption capabilities in Direct mode, which enables you to:

  • Encrypt a database.
  • Connect to an encrypted database.
  • Change the encryption key.
  • Decrypt a database.

Note

SQLite doesn’t define a standard for database encryption. The encryption implementation in this connector is only compatible with other Devart products for SQLite:

  • dbExpress Driver for SQLite
  • Excel Add-in for SQLite
  • Python Connector for SQLite
  • SSIS Data Flow Components for SQLite
  • dotConnect for SQLite
  • SQLite Data Access Components (LiteDAC)
  • Universal Data Access Components (UniDAC)

The connector can work with databases that were encrypted by itself or other Devart products.

Encrypt a database

Use the following PRAGMA statements to encrypt a database:

  • PRAGMA ENCRYPTION – Specifies the algorithm for encrypting an unencrypted database. It can’t be used on a database encrypted with a different algorithm. Available values: TripleDES, Blowfish, AES128, AES192, AES256, Cast128, or RC4.

  • PRAGMA REKEY – Encrypts an unencrypted database, changes the encryption key of an encrypted database, or decrypts a database.

You can run these statements in your database tool that uses Devart ODBC Driver for SQLite after you connect in Direct mode.

Tip

You can enable Direct mode in the DSN settings or by setting the Direct parameter to True in the connection string.

DRIVER=Devart ODBC Driver for SQLite;Direct=True;Database=D:\DeptEmp.db3

Sample commands to encrypt a database:

PRAGMA ENCRYPTION=TripleDES;
PRAGMA REKEY='encryptionKey';

Connect to an encrypted database

To connect to an encrypted database, enable Direct mode and specify the Encryption Algorithm and Encryption Key in the DSN settings or the connection string.

DRIVER=Devart ODBC Driver for SQLite;Direct=True;Database=D:\DeptEmp.db3;Encryption Algorithm=TripleDES;Encryption Key=encryptionKey

Change the encryption key

To change the encryption key, connect to the database, then execute the PRAGMA REKEY statement specifying the new encryption key.

PRAGMA REKEY='newKey';

Decrypt a database

To decrypt a database, connect to the database, then execute the PRAGMA REKEY statement with an empty value.

PRAGMA REKEY='';