Encrypting the content of Emacs Org filesOrg mode is a super tool for managing your life in plain text.
However it has a problem: the content is, well, plain text. This can quickly become an obstacle when you are going to deal with distributing your org files across several machines, e.g., by means of a common repository.
After all, we all have secrets!
However, Org mode has a builtin capability to encrypt sections of a tree so that you can still have your plain text files, but its content will not be shown to someone else.
The idea is simple:
- you configure a particular tag to add to an header;
- whenever the file is going to be saved, the sections with the heading containg the above tag will be encrypted.
Danger Will Robinson!
This is not a perfect tool, and there are a few different ways to let information to escape. For example, if you cancel the request for an encryption password, the file will be saved on disk as full plain text. Again, if you have auto-save enabled, the backup files will have no encryption at all.
Configuring Emacs for (symmetric) Org Mode EncryptionThe example shown here is taken from the official manual page of
In your Emacs configuration file place the following:
(require 'org-crypt) (org-crypt-use-before-save-magic) (setq org-tags-exclude-from-inheritance (quote ("crypt"))) (setq org-crypt-key nil)
The first line enables the
org-cryptfeature, the second line tells the encryption to activate whenever a file is saved. The third line defines the tag that will trigger the encryption, and the last line tells no particular encryption key will be used. When no key is specified, Emacs will prompt you for an encryption passphrase, that will be used for both encryption and decryption.
Symmetric Encryption in ActionLet’s start with a very simple Org file: I place a few sections and nest two sections (level two headings) that must be encrypted. I therefore place the
crypttag on the headings of the sub-sections I want to encrypt and then save the file. All the sections with the
crypttag will be encrypted when you ask for saving the file. In fact, as soon as you hit
C-x C-s, a dialog window pops up asking you for the passphrase (you have to enter it twice):
the content of the file changes: the sections with the
crypttag now show an encrypted bunch of text:
Decrypting a SectionThe special command
org-decrypt-entrywill decrypt the Org entry at the point, that is you can place the cursor wherever within the encrypted text and the section will be decrypted (of course, by means of the passphrase):
There is also the command
org-decrypt-entriesthat will automatically decrypt any section you have within the file.
org-cryptis an easy embedded feature that allows you to encrypt sections of your Org files, and this is an enhancement that allows us to store such files on remote and publicly available locations without revealing confidential data.
Of course this is not the only tool we have, but it does suffice in day-by-day usage and simple scenarios. More complex workflow could require a full file encryption by means of tools like
It is important to be aware that
org-cryptdoes not provide a perfect workflow, and there could be some ways to obtain access to plain information.