[Yandex Cloud documentation](../../index.md) > [Yandex Key Management Service](../index.md) > Getting started

# Getting started with Key Management Service

In this guide, you create your first [key](../concepts/index.md) and encrypt and decrypt text using the KMS. 

## Getting started {#before-you-begin}

To get started with Key Management Service:

1. Log in to the [management console](https://console.yandex.cloud). If you have not signed up yet, navigate to the management console and follow the instructions.
1. On the [**Yandex Cloud Billing**](https://center.yandex.cloud/billing/accounts) page, make sure you have a [billing account](../../billing/concepts/billing-account.md) linked and its status is `ACTIVE` or `TRIAL_ACTIVE`. If you do not have a billing account yet, [create one](../../billing/quickstart/index.md#create_billing_account).
1. [Assign](../../iam/operations/roles/grant.md) to your Yandex Cloud account the `owner` or `editor` role or higher for the cloud of your choice.

    {% note info %}
    
    If you cannot manage roles, contact your cloud or organization administrator.
    
    {% endnote %}

1. If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

## Create a symmetric encryption key {#create-key}

{% list tabs group=instructions %}

- Management console {#console}
    
    Create a symmetric encryption key: 
    1. In the [management console](https://console.yandex.cloud), select the folder where you want to create a key.
    1. Navigate to **Key Management Service**.
    1. In the left-hand panel, select ![image](../../_assets/console-icons/key.svg) **Symmetric keys**.
    1. Click **Create key** and set the key parameters:
       * In the **Name** field, specify `my-first-key`.
       * In the **Encryption algorithm** field, specify `AES-256`.
       * In the **Rotation period, days** field, leave `No rotation`.
       * Click **Create**.
    1. Click the line with the key name and make sure the **Versions** section contains the first key version.

{% endlist %}

## Encrypt text using the key {#encrypt}

Come up with a secret text, for example: <q>The launch is scheduled for Marchember 42.</q>. The text size must not exceed 32 KB. To encrypt large volumes of data, use [envelope encryption](../concepts/envelope.md).

{% list tabs group=instructions %}

- CLI {#cli}

    Encrypt the text:
    
    1. Save the secret text to the `plaintext.txt` file.
    1. Copy the ID of the previously created key from the management console.
        1. In the [management console](https://console.yandex.cloud), go to the folder the key was created in.
        1. Navigate to **Key Management Service**.
        1. In the window that opens, copy the key from the **ID** field.
    1. Encrypt the text:
    
       ```
       yc kms symmetric-crypto encrypt \
        --id <key_ID> \
        --plaintext-file plaintext.txt \
        --ciphertext-file ciphertext
       ```

    The result is a binary file named `ciphertext` containing ciphertext.

{% endlist %}

## Decrypt the text {#decrypt}

Decrypt the `ciphertext` binary file from the previous step.

{% list tabs group=instructions %}

- CLI {#cli}

    Decrypt the text:
    
    ```
    yc kms symmetric-crypto decrypt \
    --id <key_ID> \
    --ciphertext-file ciphertext \
    --plaintext-file decrypted.txt
    ```
    
    As a result, the `ciphertext` file will be decrypted and the following decrypted text will be written to the `decrypted.txt` file: <q>The launch is scheduled for Marchember 42.</q>.

{% endlist %}

#### See also {#see-also}

* [Updating keys](../operations/key.md#update)
* [Rotating a key](../operations/key.md#rotate)
* [Changing the default key version](../operations/version.md#make-primary)