# Secure channel encryption (/en/realtime-media/broadcast-streaming/build/secure-and-protect-channels/media-stream-encryption)

> For AI agents: see the complete documentation index at [llms.txt](/llms.txt).

Media stream encryption refers to encrypting audio and video streams in an app using a unique [key](https://en.wikipedia.org/wiki/Public_key_certificate) and [salt](https://en.wikipedia.org/wiki/Salt_\(cryptography\)) controlled by the app developer. Encryption ensures that only the authorized users in a channel see and hear each other. Video SDK provides built-in encryption methods that you can use to guarantee data confidentiality during transmission.

This article describes how to integrate Agora built-in media stream encryption into your app.

## Understand the tech [#understand-the-tech]

The following figure illustrates the process of data transfer with media stream encryption enabled.

**Data transfer process**

![EncryptMediaStream](https://assets-docs.agora.io/images/video-sdk/encrypt_media_streams_dataTransferProcess-web.svg)

## Prerequisites [#prerequisites]

Ensure that you have implemented the [SDK quickstart](../../index) in your project.

## Implement media stream encryption [#implement-media-stream-encryption]

This section shows you how to add built-in media stream encryption to your app.

Video SDK supports the following encryption modes:

* `"aes-128-xts"`: 128-bit AES encryption, XTS mode.
* `"aes-256-xts"`: 256-bit AES encryption, XTS mode.
* `"aes-128-gcm"`: 128-bit AES encryption, GCM mode.
* `"aes-256-gcm"`: 256-bit AES encryption, GCM mode.
* `"aes-128-ecb"`: 128-bit AES encryption, ECB mode.
* `"sm4-128-ecb"`: 128-bit SM4 encryption, ECB mode.

Available only in Web SDK v4.5.0 and higher:

* `"aes-128-gcm2"`: 128-bit AES encryption, GCM mode, salted.
* `"aes-256-gcm2"`: 256-bit AES encryption, GCM mode, salted.

For maximum security, best practice is to set the encryption mode to `"aes-128-gcm2"` or `"aes-256-gcm2"`, and specify an encryption key and salt. If you choose another encryption mode, you only need to specify the encryption key.

To add built-in media stream encryption to your app, refer to the following steps:

1. Generate a key and salt on your server

   * To generate a random 32-byte hexadecimal key on your server as a string, refer to the following `OpenSSL` command:

     ```bash
     # Generate a 32-byte hexadecimal key
     openssl rand -hex 32
     ```

   * To generate a random Base64-encoded, 32-byte salt on your server, refer to the following `OpenSSL` command:

     ```bash
     # Generate a Base64-encoded, 32-byte salt
     openssl rand -base64 32
     ```

2. Implement client-side logic

3. Obtain a String key and Base64-encoded salt from the server.

4. Before joining a channel, call `AgoraRTCClient.setEncryptionConfig` to select the encryption mode and specify the encryption key and salt.

5. When you call `setEncryptionConfig`, the web client:

   * Converts the key from Hex to ASCII, before passing it to the Video SDK.

   * Converts the salt from Base64 to Uint8Array, before passing it to the Video SDK.

<CalloutContainer type="info">
  <CalloutDescription>
    * All users in a channel must use the same encryption mode, key, and salt. Discrepancies may lead to unexpected behavior, such as black screens or audio loss.
      * To ensure security, best practice is to use a new key and salt each time you enable media stream encryption.
  </CalloutDescription>
</CalloutContainer>

To implement this logic, refer to the following code:

```javascript
// Declare a utility function to convert Base64 to Uint8Array
function base64ToUint8Array(base64Str: string): Uint8Array {
  const raw = window.atob(base64Str);
  const result = new Uint8Array(new ArrayBuffer(raw.length));

  for (let i = 0; i < raw.length; i += 1) {
    result[i] = raw.charCodeAt(i);
  }

  return result;
}

// Declare a utility function to convert Hex to ASCII
function hex2ascii(hexx) {
  const hex = hexx.toString();//force conversion
  let str = '';
  for (let i = 0; i < hex.length; i += 2)
    str += String.fromCharCode(parseInt(hex.substr(i, 2), 16));
  return str;
}

async function getSecretAndSalt() {
  // Retrieve the key and salt value from the server
  let [secret, salt] = await getSecretAndSaltFromServer();
  salt = base64ToUint8Array(salt);
  secret = hex2ascii(secret);
  return [secret, salt];
}

let [secret, salt] = await getSecretAndSalt();

// Set the encryption scheme to AES-256-GCM2 and pass in secret and salt
client.setEncryptionConfig("aes-256-gcm2", secret, salt);
```

The sample code refers to the local `client` object created using `AgoraRTC.createClient`

## Reference [#reference]

This section contains content that completes the information on this page, or points you to documentation that explains other aspects to this product.

### Development considerations [#development-considerations]

The media stream encryption feature is supported in both communication and live broadcasting use-cases. However, in the live broadcasting use-case, Agora does not support pushing the encrypted media stream to CDN.

### API reference [#api-reference]

* [`setEncryptionConfig`](https://api-ref.agora.io/en/video-sdk/web/4.x/interfaces/iagorartcclient.html#setencryptionconfig)
* [`EncryptionMode`](https://api-ref.agora.io/en/video-sdk/web/4.x/globals.html#encryptionmode)