# How to Encrypt Existing Android Room DB

**URL:** <https://discuss.zetetic.net/t/how-to-encrypt-existing-android-room-db/4547>\
**Category:** SQLCipher\
**Created:** [August 10, 2020, 11:53pm UTC](https://discuss.zetetic.net/t/how-to-encrypt-existing-android-room-db/4547 "2020-08-10T23:53:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![json](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@json](https://discuss.zetetic.net/u/json)\
**Post date:** [August 10, 2020, 11:53pm UTC](https://discuss.zetetic.net/t/how-to-encrypt-existing-android-room-db/4547/1 "2020-08-10T23:53:56Z")

</div>

Currently, creating a Room database looks like so:

```
            return Room.databaseBuilder(context.applicationContext, AppDatabase::class.java, DB_NAME)
                .addMigrations(...)
                .fallbackToDestructiveMigrationFrom(...)
                .build()

```

I want to encrypt this DB, so using SQLCipher, I’ve generated a secure passphrase, and can create a new, encrypted DB like so:

```
        val factory = SupportFactory(passphrase, null, false)
        return Room.databaseBuilder(context.applicationContext, AppDatabase::class.java, DB_NAME)
                .openHelperFactory(factory)
                .addMigrations(...)
                .fallbackToDestructiveMigrationFrom(...)
                .build()

```

This all works fine, but it only creates a new, encrypted DB, which forces me to delete the old DB before creating the new one in this fashion. How do I go about encrypting an existing DB?  
I’ve looked at the example #1 that some people have recommended, but that doesn’t really help, since it’s just a command line instruction to encrypt/attach a DB. Is there not a way to do this through the gradle library?

My ultimate goal is to encrypt the existing DB such that it retains the data.

---

<div class="post-metadata">

**Author:** ![commonsguy](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/commonsguy/32/75_2.png) [@commonsguy](https://discuss.zetetic.net/u/commonsguy)\
**Post date:** [August 11, 2020, 12:40pm UTC](https://discuss.zetetic.net/t/how-to-encrypt-existing-android-room-db/4547/2 "2020-08-11T12:40:32Z")

</div>

FWIW, that was discussed previously in this board — see [this post](https://discuss.zetetic.net/t/how-to-apply-sqlcipher-to-pre-existing-room-database/4320/2), for example.

---

<div class="post-metadata">

**Author:** ![json](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@json](https://discuss.zetetic.net/u/json)\
**Post date:** [August 11, 2020, 4:30pm UTC](https://discuss.zetetic.net/t/how-to-encrypt-existing-android-room-db/4547/3 "2020-08-11T16:30:39Z")

</div>

Ah, good find @commonsguy. This is exactly what I ended up doing. I was so surprised that development for your SafeRoom library ended, as the new SQLCipher library doesn’t have any of the convenient util methods you provided.  
Have you thought about forking the new repo and making a PR to include your utils class?  
Either way, I’ll be writing a (free) Medium article about this solution to make it easier for other devs to find this information, instead of scouring these forums for an answer.

By the way, I found that the method you linked requires the `WRITE_EXTERNAL_STORAGE` permission. One way to go around this was to change the creation of the `tmp` file like so:

```
val newFile = File.createTempFile("sqlcipherutils", "tmp", File(originalFile.parent))

```

In any case, thanks for providing a solution to this! SafeRoom has been a lifesaver.

---

<div class="post-metadata">

**Author:** ![commonsguy](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/commonsguy/32/75_2.png) [@commonsguy](https://discuss.zetetic.net/u/commonsguy)\
**Post date:** [August 11, 2020, 4:47pm UTC](https://discuss.zetetic.net/t/how-to-encrypt-existing-android-room-db/4547/4 "2020-08-11T16:47:15Z")

</div>

> [@json](#):
>
> Have you thought about forking the new repo and making a PR to include your utils class?

If the Zetetic team would like that contribution, I’d be happy to make it! I forget if we discussed it back when I made the original contributions or not.

> [@json](#):
>
> I found that the method you linked requires the `WRITE_EXTERNAL_STORAGE` permission

Off the cuff, I don’t see how. I use `getCacheDir()`, which is on internal storage.

---

<div class="post-metadata">

**Author:** ![json](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@json](https://discuss.zetetic.net/u/json)\
**Post date:** [August 11, 2020, 5:20pm UTC](https://discuss.zetetic.net/t/how-to-encrypt-existing-android-room-db/4547/5 "2020-08-11T17:20:23Z")

</div>

That would be awesome.

Sorry, I should have clarified: This issue only stems in a test environment (such as JUnit). I haven’t dug into any workarounds or resolutions, as this code change addresses the issue and doesn’t really have any other side-effects since the `tmp` file is deleted either way.

This could also be a permission requirement for API 23 and above.