---
title: "Supabase Vault is now in Beta"
description: "Supabase Vault is a Postgres extension and accompanying dashboard UI for storing encrypted secrets and encrypting data in database tables, released progressively across the platform and later made available on all Supabase projects. It stores secrets and encryption keys using authenticated encryption on disk, exposes decrypted secrets through a Postgres view, and lets applications use them from SQL in functions, triggers, and webhooks. Its foundation is pgsodium Transparent Column Encryption (TCE), which can encrypt text or bytea values, authenticate associated row columns, and create row-by-row decryption views for encrypted columns. Encryption keys are kept outside the database while only key IDs are stored with encrypted data; Supabase manages root keys in internal backend systems and offers an alternate dashboard endpoint for external decryption, while the post also outlines possible future end-to-end, group, and public-key encryption features."
---

# Supabase Vault is now in Beta

[Supabase](https://yomu.fyi/company/supabase) · michel · Dec 16, 2022

**Type:** Announcement

## Summary

Supabase Vault is a Postgres extension and accompanying dashboard UI for storing encrypted secrets and encrypting data in database tables, released progressively across the platform and later made available on all Supabase projects. It stores secrets and encryption keys using authenticated encryption on disk, exposes decrypted secrets through a Postgres view, and lets applications use them from SQL in functions, triggers, and webhooks. Its foundation is pgsodium Transparent Column Encryption (TCE), which can encrypt text or bytea values, authenticate associated row columns, and create row-by-row decryption views for encrypted columns. Encryption keys are kept outside the database while only key IDs are stored with encrypted data; Supabase manages root keys in internal backend systems and offers an alternate dashboard endpoint for external decryption, while the post also outlines possible future end-to-end, group, and public-key encryption features.

## Context

Supabase introduced Vault to make it safe and easy to store encrypted secrets and encrypt other stored data in a database. The post positions it as a foundation for capabilities beyond those available in a stock Postgres distribution, with privacy as an important motivation.

## Approach / What changed

Vault combines a Postgres extension based on pgsodium Transparent Column Encryption with a Supabase dashboard UI. It provides Secrets and Encryption Keys, encrypted columns for existing tables, automatically created decryption views, authenticated encryption with associated data, and key management in Supabase systems outside the database.

## Takeaways

- Secrets are stored encrypted and authenticated on disk, while applications can access decrypted values through a Postgres view from functions, triggers, webhooks, or SQL.
- Transparent Column Encryption can encrypt any Postgres value castable to text or bytea, authenticate associated row columns, and expose decrypted values through an automatically created view.
- Only encryption key IDs are stored with encrypted data; Supabase keeps the root keys outside the database and provides an alternate dashboard endpoint for decrypting data outside Supabase.

**Tags:** [Postgres](https://yomu.fyi/topic/postgres), [Privacy](https://yomu.fyi/topic/privacy)

- Source: [Supabase](https://supabase.com/blog/vault-now-in-beta)
- Source URL: https://supabase.com/blog/vault-now-in-beta
- Ingested by Yomu: 2026-08-29T01:15:39.256Z

[Read original post](https://supabase.com/blog/vault-now-in-beta)