class Inquiry < ApplicationRecord
  encrypts :email
end

> inquiry = Inquiry.create(email: "encrypted@example.com")
  TRANSACTION (0.2ms)  BEGIN
  Inquiry Create (1.0ms)  INSERT INTO "inquiries" ("email") VALUES ($1) RETURNING "id"  [["email", "{\"p\":\"q8wrMdpuKWGgRcTMqx9OdUbHISCJ\",\"h\":{\"iv\":\"kcaByOC0JWLrzup6\",\"at\":\"XGOMVg2FvHhPn8uNCn6XSw==\"}}"]]
  TRANSACTION (0.7ms)  COMMIT

> inquiry.email
=> "encrypted@example.com"

        def encrypt(clear_text)
          # This code is extracted from +ActiveSupport::MessageEncryptor+. Not using it directly because we want to control
          # the message format and only serialize things once at the +ActiveRecord::Encryption::Message+ level. Also, this
          # cipher is prepared to deal with deterministic/non deterministic encryption modes.

          cipher = OpenSSL::Cipher.new(CIPHER_TYPE)
          cipher.encrypt
          cipher.key = @secret

          iv = generate_iv(cipher, clear_text)
          cipher.iv = iv

          encrypted_data = clear_text.empty? ? clear_text.dup : cipher.update(clear_text)
          encrypted_data << cipher.final

          ActiveRecord::Encryption::Message.new(payload: encrypted_data).tap do |message|
            message.headers.iv = iv
            message.headers.auth_tag = cipher.auth_tag
          end
        end

$ bin/rails db:encryption:init
Add this entry to the credentials of the target environment:

active_record_encryption:
  primary_key: EGY8WhulUOXixybod7ZWwMIL68R9o5kC
  deterministic_key: aPA5XyALhf75NNnMzaspW7akTfZp0lPY
  key_derivation_salt: xEY0dt6TZcAMg52K7O84wYzkjvbA62Hz

  create_table :users do |t|
    t.string :name
    t.string :encrypted_ssn
    t.string :encrypted_ssn_iv
    t.timestamps
  end

  class User
    attr_encrypted :ssn, key: 'This is a key that is 256 bits!!'
  end

encrypted_otp_secret
encrypted_otp_secret_iv
encrypted_otp_secret_salt

consumed_timestep
otp_required_for_login

class MyModel < ActiveRecord::Base
  crypt_keeper :field, :other_field, encryptor: :active_support, key: 'super_good_password', salt: 'salt'
end

model = MyModel.new(field: 'sometext')
model.save! #=> Your data is now encrypted
model.field #=> 'sometext'

      def initialize(options = {})
        key  = options.fetch(:key)
        salt = options.fetch(:salt)

        @encryptor = ::ActiveSupport::MessageEncryptor.new \
          ::ActiveSupport::KeyGenerator.new(key).generate_key(salt, 32)
      end

class AddEmailCiphertextToUsers < ActiveRecord::Migration[7.0]
  def change
    add_column :users, :email_ciphertext, :text
  end
end

class User < ApplicationRecord
  has_encrypted :email
end

> user = User.create!(email: "encrypted@example.com")
  TRANSACTION (0.2ms)  BEGIN
  User Create (3.9ms) INSERT INTO "email" ("email") VALUES ($1) RETURNING "id"  [["email_ciphertext", "gq+5PVbKxR7D7yZU18J5Dkg4pPu0nGYyVkuj1KAT5d85bEjhmYx2h6nVAoWBejOmdh3AHtHCuJCzEogL"]]
  TRANSACTION (0.7ms)  COMMIT
=> #<User id: 1, email: [FILTERED]">

> User.email
=> "encrypted@example.com"

    def encrypt(message, **options)
      message = check_string(message)
      ciphertext = @boxes.first.encrypt(message, **options)
      ciphertext = Base64.strict_encode64(ciphertext) if @encode
      ciphertext
    end

> Lockbox.generate_key

lockbox:
  master_key: "0000000000000000000000000000000000000000000000000000000000000000"

class PointLog < ActiveRecord::Base
  encrypted_attribute(:date, :date)
  encrypted_attribute(:point, :integer, default: -> { Current.user.current_point })
  encrypted_attribute(:price, Money.new)
  encrypted_attribute(:serialized_address, :string)

  # Change encryptor
  encrypted_attribute(:name, :field, encryption: { encryptor: :active_support, key: ENV['ENCRYPTION_KEY'], salt: ENV['ENCRYPTION_SALT'] })
end

      def initialize(key:, salt:, cipher: nil)
        key_generator = ::ActiveSupport::KeyGenerator.new(key)
        @encryptor = ::ActiveSupport::MessageEncryptor.new(key_generator.generate_key(salt, 32), cipher: cipher)
      end