We want to encrypt / encode URL parameters on our pages. What is the best way to achieve this in apex, visualforce. Most of our methods in controller are Remote Actions used via Visualforce remoting.

  • What's the goal of this encryption? Jun 12, 2015 at 17:14
  • These URL parameters are used in apex logic as bind variables in SOQL queries. We dont want to allow users to change URL parameters which may have security issue.
    – Walker
    Jun 13, 2015 at 4:27

1 Answer 1


If it is a managed package you can encrypt the values using a predefined key as none can see the code. If it is not a managed package then the visibility of the code could be an issue

How you generate and store the key will depend on your situation. As sfdcfox stated, a random key stored in a protected custom setting would be best. You could even write logic to automatically update it after a period of time....(although urls from previous key would no longer work)

The following will encrypt an ID:

public static Blob key = Blob.valueOf('1920183741');

public static Map<ID,String> encryptID(Set<ID> invitee_id){

    Map<ID,String> results = New Map<ID,String>();

    for(String i : invitee_id){
        //encrypted blob
        Blob cipherText = Crypto.encryptWithManagedIV('AES128', key, Blob.valueOf(i));
        //encrypted string
        String encodedCipherText = EncodingUtil.base64Encode(cipherText);



    return results;


The only caveat is that the code to decrypt will need to be using the same key:

public static string decryptID(String id_param){
    if(id_param == null) return null;
    //encrypted blob
    Blob encodedEncryptedBlob = EncodingUtil.base64Decode(id_param);
    //decrypted blob
    Blob decryptedBlob = Crypto.decryptWithManagedIV('AES128', key, encodedEncryptedBlob);
    //decrypted string
    String decryptedClearText = decryptedBlob.toString();


    return decryptedClearText;


Not sure if this is a best practice or not but it works for the purposes we are using it for

  • 3
    That's what I was going to say. The only difference is that I'd generate a random key with Crypto.generateAesKey and store that in a custom setting, which is marginally more secure and easier to fix if one of your users figures out the key is the name of your favorite dog. Of course, for internal use only, it's probably secure enough as written. For managed packages, I'd avoid a hard-coded key.
    – sfdcfox
    Jun 12, 2015 at 17:34
  • 3
    re @sfcdfox's comment, that's what I do in a package - the install script creates a random key and stores that in a protected custom setting, and then there is a class in the package to handle the encryption/decryption that gets the key from the setting Jun 12, 2015 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.