Envelope encryption
Last verified
Envelope encryption encrypts data with a data key, then encrypts that data key with a master key held elsewhere. Compromising the stored ciphertext alone is not enough — you also need the master key.
It is the standard pattern when a credential genuinely must be held server-side, for example so a scheduled job can act on your behalf. The security then rests on the separation between the two key stores and on the master key never being written alongside the data.
Strictly weaker than not storing the credential at all, which is why device-only storage is preferable where the design allows it.