django-fernet-encrypted-fields

Django Fernet Encrypted Fields provides drop-in Django model field types that transparently encrypt their values before they are written to the database and decrypt them when read back. Encryption uses Fernet symmetric cryptography keyed from your Django SECRET_KEY and a configurable SALT_KEY.

Created as a successor to django-encrypted-fields, it supports salt-key and secret-key rotation so you can migrate to new keys without losing access to existing data, making it a practical way to protect sensitive columns at rest.

What You Get

• Encrypted field types like EncryptedTextField, EncryptedCharField, and more
• Transparent Fernet encryption on write and decryption on read
• Keys derived from Django SECRET_KEY plus a configurable SALT_KEY
• Salt-key rotation via an ordered list of keys for zero-downtime migration
• SECRET_KEY rotation support using Django’s SECRET_KEY_FALLBACKS

Common Use Cases

• Encrypting sensitive columns such as tokens, PII, or notes at rest
• Meeting compliance requirements for data-at-rest encryption
• Rotating encryption keys without downtime or data loss
• Migrating away from the unmaintained django-encrypted-fields

Under The Hood

Architecture - The library lives under src/encrypted_fields and defines encrypted field subclasses of Django’s model fields. Each field overrides the value lifecycle: on get_prep_value/save it derives a Fernet key from Django’s SECRET_KEY and the configured SALT_KEY, encrypts the serialized value, and stores the ciphertext; on load it attempts decryption across the configured key list, enabling seamless rotation. Tech Stack - Pure Python built on Django’s model field API and the cryptography library’s Fernet implementation, packaged with a modern pyproject.toml. A bundled package_test project and manage.py provide a Django harness for testing. Code Quality - The repository includes a test project, a maintained CHANGELOG, and contributing guidelines under the Jazzband umbrella; the codebase is small and focused, though maintenance cadence is intermittent. Key-rotation logic that tries multiple keys in order is the most safety-critical part and is exercised by the test suite. API Design - Adoption is essentially frictionless: set a SALT_KEY setting, import an encrypted field type, and use it exactly like the native field, with no query-time changes. The README documents both salt and secret-key rotation clearly, giving a very gentle learning curve.