Add encrypted SQLCipher WatermelonDB JSI by ororsatti · Pull Request #1635 · Nozbe/WatermelonDB

ororsatti · 2023-07-31T11:10:08Z

ideally i'd like to avoid adding to the non-JSI version since its going to be less and less supported as we progress with JSI in RN.

TODO:

Add SQLCipher to Android
Add an option to select sqlite build (sqlite3/sqlCipher - this seem to be a requirement on the last PR trying to add sqlcipher) on Android
ADD SQLCipher to iOS
Add an option to select sqlite build (sqlite3/sqlCipher - this seem to be a requirement on the last PR trying to add sqlcipher) iOS
Change API to accept passphase.
Add sqlcipher amalgamation to nozbe workspace (same method as sqlite and simdjson) @radex
Fix iOS tests

Changes: - add a flag if using encrypted DB - install openssl if using encrypted db

- add pathes to cipher amalgamation based on the flags. - add openSSL lib

ororsatti · 2023-08-04T08:41:36Z

@radex I can not seem to run the ios/android tests properly, any chance you help me with it?

killerchip · 2024-01-17T10:18:53Z

Hey guys,

Thanks for your great work on this, and thanks for the great library

Is this PR still alive? Is there still interest in Nozbe in adding encryption to the DB?
We are also looking into using WatermelonDB with encryption on native (Android mainly). But C++ is currently out of my league. Do you know how I can help?

I was able to make something work based on this PR #907, but of course, it does not support JSI.

@ororsatti, does your PR work? I just did a test, but it seems that the DB is not getting encrypted (Android).

ororsatti · 2024-01-17T10:25:55Z

Hey guys,

Thanks for your great work on this, and thanks for the great library

Is this PR still alive? Is there still interest in Nozbe in adding encryption to the DB?
We are also looking into using WatermelonDB with encryption on native (Android mainly). But C++ is currently out of my league. Do you know how I can help?

I was able to make something work based on this PR #907, but of course, it does not support JSI.

@ororsatti, does your PR work? I just did a test, but it seems that the DB is not getting encrypted (Android).

I'm using it in several production apps, so yep.
I might be able to help talk to me this evening:
orsatti@skiff.com

killerchip · 2024-01-19T07:21:21Z

I'm using it in several production apps, so yep. I might be able to help talk to me this evening: orsatti@skiff.com

@ororsatti thank you very much for your valuable help on this. Indeed your PR works as expected.
As we discussed it would be awesome if this could turn into a separate WMDB adapter.

@radex would it be preferable to make it into a separate adapter? Or just as an option to the base SQLite adapter as is with this PR?

ororsatti · 2024-04-05T09:23:09Z

I'm using it in several production apps, so yep. I might be able to help talk to me this evening: orsatti@skiff.com

@ororsatti thank you very much for your valuable help on this. Indeed your PR works as expected.
As we discussed it would be awesome if this could turn into a separate WMDB adapter.

@radex would it be preferable to make it into a separate adapter? Or just as an option to the base SQLite adapter as is with this PR?

I don't think making it an adapter is the right decision.
An adapter is the middle layer, what stands between your app, and the underlying SQLite.
Since I am not changing the platform, nor the api, I don't see a reason to change the adapter here.
It should be as it is, a flag on which you raise if you want to use it, and pass password if you desire.

ororsatti · 2024-04-05T09:27:00Z

I'm using it in several production apps, so yep. I might be able to help talk to me this evening: orsatti@skiff.com

@ororsatti thank you very much for your valuable help on this. Indeed your PR works as expected.
As we discussed it would be awesome if this could turn into a separate WMDB adapter.

@radex would it be preferable to make it into a separate adapter? Or just as an option to the base SQLite adapter as is with this PR?

You can think about it like it's a car.
If you change the engine, but as long as it has the same gear, i.e the same API, you don't have to learn manual.
Same here, the api is the same, so no need to change the adapter.

dlogvin · 2024-10-26T18:55:21Z

Hey! just wanted to check if this PR is still alive

ororsatti · 2024-11-06T15:08:20Z

Hey! just wanted to check if this PR is still alive

im still maintaining it from time to time, but i don't think the lib owner merges community PRs...

dlogvin · 2024-11-06T15:34:24Z

Hey! just wanted to check if this PR is still alive

im still maintaining it from time to time, but i don't think the lib owner merges community PRs...

That's quite sad. Adding encryption definitely is important, if not a requirement nowadays. Then I guess we have to fork 🫡

When I was looking at this library, I was hoping it had some sort of encryption capabilities, but I quickly left it as it came to my understanding that such a thing is probably not coming in the near future for this lib.

ororsatti · 2024-11-07T10:30:30Z

Hey! just wanted to check if this PR is still alive

im still maintaining it from time to time, but i don't think the lib owner merges community PRs...

That's quite sad. Adding encryption definitely is important, if not a requirement nowadays. Then I guess we have to fork 🫡

When I was looking at this library, I was hoping it had some sort of encryption capabilities, but I quickly left it as it came to my understanding that such a thing is probably not coming in the near future for this lib.

well this pr works, this pr in particular was used by me in production multiple times, and by a few more of the community... you can just use it. the conflicts doesn't seem that bad tbh

kmye · 2024-11-09T03:19:02Z

i have tried to use the codes in this PR but there are build errors

e.g.

/mobile/ios/Pods/SQLCipher/sqlite3.h:1767:8: error: redefinition of 'sqlite3_mem_methods'
1767 | struct sqlite3_mem_methods {
|        ^
    In file included from /node_modules/@nozbe/watermelondb/native/ios/WatermelonDB/DatabasePlatformIOS.mm:1:
    In file included from /node_modules/@nozbe/watermelondb/native/shared/DatabasePlatform.h:5:
    In file included from /node_modules/@nozbe/watermelondb/native/shared/Database.h:7:

this seems to be caused by conflicting sqlite pod in my app, my app also include other libraries which includes sqlite and these could hgave caused the redefinition error. anyone has a solution this issue?

rtripplanningbiz · 2024-12-13T21:52:45Z

I'm using it in several production apps, so yep. I might be able to help talk to me this evening: orsatti@skiff.com

@ororsatti thank you very much for your valuable help on this. Indeed your PR works as expected. As we discussed it would be awesome if this could turn into a separate WMDB adapter.

@radex would it be preferable to make it into a separate adapter? Or just as an option to the base SQLite adapter as is with this PR?

Hi, how did you get it to encrypt in android? I haven't tried on IOS since I don't need it there. Android I am able to build but the database is not encrypted. Thanks!

AlexanderDMitchell · 2025-03-20T08:17:40Z

Hi, since securely storing a passphrase (e.g., with Expo SecureStore) requires asynchronous retrieval, how are you handling that with WatermelonDB’s initialization? Given that WatermelonDB is typically initialized at the top level where async/await can’t be used? Thanks

MichelNassarFC · 2025-04-29T11:44:48Z

any update on this?
its crucial to have encryptions

ororsatti · 2025-04-29T13:48:45Z

Hi, since securely storing a passphrase (e.g., with Expo SecureStore) requires asynchronous retrieval, how are you handling that with WatermelonDB’s initialization? Given that WatermelonDB is typically initialized at the top level where async/await can’t be used? Thanks

hm? I had a user private key to work with. Didn't need to store anything?

ororsatti · 2025-04-29T13:49:04Z

any update on this? its crucial to have encryptions

:(
just fork or something.

annkiit2 · 2025-12-12T11:20:19Z

@radex Encryption with New Arch and jsi is a must now given encryption at rest is extremely important. Please give us a timeline on this. Using forks is risky

Based on PR Nozbe#1635 from Nozbe/WatermelonDB: - Add SQLCipher amalgamation files - Update native C++ to accept password parameter - Add iOS SQLCipher support via podspec ($isEncryptedDB flag) - Add Android SQLCipher support via build.gradle and CMakeLists.txt - Add passphrase option to SQLiteAdapterOptions

## Summary This PR adds SQLCipher encryption support to WatermelonDB, enabling encrypted SQLite databases on iOS and Android. Based on Nozbe#1635, merged and refined for our needs. Key changes: - New passphrase option in SQLiteAdapter to enable database encryption - Bundled SQLCipher amalgamation (sqlite3.c/h) for native encryption support - Automatic plaintext database detection and wipe - when encryption is enabled (passphrase provided) and an existing unencrypted database is detected via isPlaintextSqlite(), the database files are automatically wiped and recreated as encrypted. This prevents encryption errors when switching from plaintext to encrypted mode. - Optimized plaintext detection - reads only the first 16 bytes of the file to check for SQLite header signature, avoiding full database open - Fork configuration - updated package name to @pinginc/watermelondb and URLs to pinginc repository for npm publishing Usage ``` const adapter = new SQLiteAdapter({ schema, passphrase: 'your-encryption-key', // enables SQLCipher encryption }) ``` > [!NOTE] > > When passphrase is provided and the existing database is unencrypted (plaintext), the database will be automatically wiped (deleted and recreated). This happens because SQLCipher cannot open a plaintext database with encryption enabled. Added to avoid crash errors. Ensure you handle data migration or backup before enabling encryption on an existing unencrypted database. ## Checklist - [x] I have updated the summary to explain what's changed. - [x] I have added unit and integration tests to cover the new functionality. - [x] I have followed the [PR Guidelines](https://timebyping.atlassian.net/wiki/spaces/TECH/pages/1629126657/Pull+Request+PR+Guidelines). --------- Co-authored-by: Jin Soo Lim <jinsoo601@gmail.com>

nikitashmidt · 2026-01-20T10:13:00Z

Hi, friend, I installed your package, but for some reason encryption isn't working. I set the isEncryptedDB variable to true, and I also saw encryptedDB in the code, which was also set to true. What could be the problem? How can I find the problem? Thank you very much for your work. @ororsatti

ororsatti · 2026-01-20T10:39:22Z

Hi, friend, I installed your package, but for some reason encryption isn't working. I set the isEncryptedDB variable to true, and I also saw encryptedDB in the code, which was also set to true. What could be the problem? How can I find the problem? Thank you very much for your work. @ororsatti

Hello bud, I do not know exactly whats going on on your side, nor can I debug this remotely.
There were so many changes in this lib and in react native since I opened this pull request, so forgive me for not knowing what's going on.

I used to try and maintain this pr but since there seems to be no interest from the maintainers in this PR, I'm not going to invest any more time trying to keep it alive.

Very much sorry,
and feel free to give other libs a try, at the time I created it no one supported this feature, but now pretty much all major SQLite libs expose db encryption.

annkiit2 · 2026-01-21T09:17:16Z

@radex Can you please look into @ororsatti 's PR ... This feature (Encryption) is very important especially when considering Offline first db

Health data (conditions, symptoms, food log, consent records) was stored in plain SQLite, readable directly on a rooted/jailbroken device or via an unencrypted local backup. WatermelonDB has no built-in encryption, so this patches SQLCipher support into its JSI SQLite adapter (adapted from Nozbe/WatermelonDB#1635, unmerged upstream) via patch-package, since the native ios/android projects are regenerated from scratch on every `expo prebuild` and can't hold a hand-edited fix. A random 256-bit key is generated once per install and stored in the Keychain/Keystore via expo-secure-store -- database init is now async (App.tsx waits on it before mounting RootNavigator) since the key must be read before the encrypted connection can open. Also fixes app.json's disableJsi: true, which only affected Android and would have silently kept it on the old non-encrypted native module even with this patch applied. Verified on iOS simulator: real build, real launch, and the on-disk dietapp.db is confirmed non-plaintext (generic `data` per `file`, wrong header, plain sqlite3 CLI refuses to open it) -- not just "build succeeded." Also verified the key persists correctly across a full app kill + relaunch. Android could not be verified in this environment (no Android SDK) -- the config plugin correctly generates a matching android/build.gradle and the property names line up with the patched native build files, but nobody has compiled or booted it yet. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Or Antonio Orsatti added 6 commits July 27, 2023 14:07

add cipher amalgamation

a698d73

Configure android jsi build file to support cipher

5d470a0

Changes: - add a flag if using encrypted DB - install openssl if using encrypted db

Configure CMake

41876a5

- add pathes to cipher amalgamation based on the flags. - add openSSL lib

add key function to jsi

1dce0c6

add password arg to js api

bf35366

temp using sqlcipher for wmdb

1c4b888

ororsatti changed the title ~~Add sqlcipher to jsi~~ Add encrypted SQLite to jsi Aug 1, 2023

ororsatti changed the title ~~Add encrypted SQLite to jsi~~ Add encrypted SQLCipher WatermelonDB JSI Aug 2, 2023

ororsatti mentioned this pull request Aug 4, 2023

Full text search (fts5) #1163

Open

Or Antonio Orsatti added 2 commits August 4, 2023 11:28

add encrypted flag to ios

c767ac4

adding docs

d0cf018

Merge branch 'master' into encrypted-db-progress

35c27c4

ororsatti mentioned this pull request Aug 15, 2024

SQLCipher disk encryption for Android + iOS #907

Open

This was referenced Jan 6, 2026

Encrypted db progress Cybionex/WatermelonDB#1

Closed

Encrypted db progress Cybionex/WatermelonDB#2

Merged

dmytech462 mentioned this pull request Jan 14, 2026

ENT-1060: add sqlcipher encryption pinginc/watermelon-db#2

Merged

3 tasks

Uh oh!

Conversation

ororsatti commented Jul 31, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TODO:

Uh oh!

ororsatti commented Aug 4, 2023

Uh oh!

killerchip commented Jan 17, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ororsatti commented Jan 17, 2024

Uh oh!

killerchip commented Jan 19, 2024

Uh oh!

ororsatti commented Apr 5, 2024

Uh oh!

ororsatti commented Apr 5, 2024

Uh oh!

dlogvin commented Oct 26, 2024

Uh oh!

ororsatti commented Nov 6, 2024

Uh oh!

dlogvin commented Nov 6, 2024

Uh oh!

ororsatti commented Nov 7, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kmye commented Nov 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rtripplanningbiz commented Dec 13, 2024

Uh oh!

AlexanderDMitchell commented Mar 20, 2025

Uh oh!

MichelNassarFC commented Apr 29, 2025

Uh oh!

ororsatti commented Apr 29, 2025

Uh oh!

ororsatti commented Apr 29, 2025

Uh oh!

annkiit2 commented Dec 12, 2025

Uh oh!

nikitashmidt commented Jan 20, 2026

Uh oh!

ororsatti commented Jan 20, 2026

Uh oh!

annkiit2 commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

ororsatti commented Jul 31, 2023 •

edited

Loading

killerchip commented Jan 17, 2024 •

edited

Loading

ororsatti commented Nov 7, 2024 •

edited

Loading

kmye commented Nov 9, 2024 •

edited

Loading

annkiit2 commented Jan 21, 2026 •

edited

Loading