Contacts
IBSurgeon

Encryption Plugin Framework for Firebird

Add transparent AES-256 encryption to Firebird databases - pre-built plugins, full sources, and an unlimited redistribution license for your business applications.

Purchase & download

Choose Unlimited alone, or Unlimited with implementation consulting from our engineers.

Unlimited license

Encryption Plugin Framework

Unlimited redistribution with your company’s business applications, full sources, pre-built binaries, Gbak, NBackup, gfix, and isql with support for encrypted databases, decrypt tool (FirstAID license included from 2021), and examples for Delphi, PHP, and more.

$1,999

Purchase

Unlimited + consulting

Framework + implementation support

Everything in Unlimited, plus consulting so our engineers help you implement and integrate encryption into your application and deployment.

$2,499

Purchase with consulting

What you get

  • Strong AES-256 encryption (other methods such as Windows Crypto API / DPAPI can be added)
  • Unlimited redistribution license for business applications owned by the licensee (per company)
  • Pre-built binaries for Firebird 3.0.3+, 4.0.x, and 5.0.x - Windows and Linux, 32-bit and 64-bit
  • Gbak, NBackup, gfix, and isql with support for encrypted databases
  • Decrypt tool for recovery of corrupted encrypted databases (works with FirstAID; FirstAID license included in Unlimited from 2021)
  • Full plugin sources and detailed implementation examples (Delphi, PHP, and more)
  • Optional implementation support and SQL development tools with encryption support

How it works

Firebird 3.0 introduced database encryption so only designated applications can open sensitive data. The framework provides source code and guidance so each application can use a custom key-delivery scheme - while developers and admins keep transparent access in a trusted environment through their usual tools.

Data is encrypted at the page level: user records, BLOBs, index keys, and sources of stored procedures and triggers. System pages (pointers, transactions, and similar) stay unencrypted for performance. Encrypt and decrypt without exclusive access - applications can keep working while the database is being encrypted or decrypted.

How to implement

Implementation has two phases: prepare the database, then wire keys into the end-user application.

1. Database phase

  1. Copy plugin files (and, if needed, firebird.conf and KeyHolder.conf) into the Firebird folder.
  2. Generate keys - as many as you need.
  3. Encrypt with ALTER DATABASE ENCRYPT WITH KEY KEYNAME (in isql or your application).
  4. Confirm gbak, gfix, and isql work with the encrypted database.

After this phase the database is encrypted. Users and standard tools keep working without changes while Firebird reads keys from KeyHolder.conf. You can also change the key holder to load keys from a safer place (for example DPAPI). Protection schemes should be individual - contact support to discuss options.

2. End-user application

  1. Embed code to initialize the encrypted connection and transfer keys. Examples for Delphi, Lazarus, PHP, .NET, and Java are available on request.
  2. Remove KeyHolder.conf from the test server and restart Firebird.
  3. Verify that the application can open the encrypted database, that standard Firebird and IDE tools cannot, and that encrypted gbak backups work.
  4. Deploy the end-user applications.

Step-by-step demo package

Licensing

The Unlimited license allows redistribution of encryption plugins to third parties when bundled with your business applications. The framework includes full plugin sources and implementation technical support for a single application. For hands-on consulting, choose the Unlimited + Consulting license above.

Technical information

  • Requires Firebird 3.0.3+ or Firebird 4.0.x / 5.0.x
  • Windows and Linux, 32-bit and 64-bit
  • Pre-built binaries are included; custom builds typically use the same toolchain as your Firebird version (historically Visual Studio for Windows plugins)

Questions? Email [email protected].