[Yandex Cloud documentation](../../../index.md) > [Yandex Key Management Service](../../index.md) > [Tutorials](../index.md) > [Data encryption](index.md) > Encrypting data using the Yandex Cloud CLI and API

# Encrypting data using the Yandex Cloud CLI and API

In Yandex Key Management Service, you can encrypt and decrypt small amounts of data (up to 32 KB). For more information about the available encryption methods, see [Which encryption method should I choose?](index.md).

## Getting started {#before-you-begin}

If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

## Encrypt data {#encryption}

{% note info %}

Changes caused by [eventually consistent operations](../../concepts/consistency.md) require up to three hours to become encryptable.

{% endnote %}

{% list tabs group=instructions %}

- CLI {#cli}

  This command will encrypt the plain text provided in `--plaintext-file` and write the resulting ciphertext to `--ciphertext-file`:

  * `--id`: ID of the [KMS key](../../concepts/key.md). Make sure you set either the `--id` or `--name` flag.
  * `--name`: Name of the KMS key. Make sure you set either the `--id` or `--name` flag.
  * `--version-id` (optional): [Version](../../concepts/version.md) of the KMS key to use for encryption. The primary version is used by default.
  * `--plaintext-file`: Input plaintext file.
  * `--aad-context-file` (optional): Input file with [AAD context](../../concepts/symmetric-encryption.md#add-context).
  * `--ciphertext-file`: Output file with ciphertext.

  ```bash
  yc kms symmetric-crypto encrypt \
    --id abj76v82fics******** \
    --plaintext-file plaintext-file \
    --ciphertext-file ciphertext-file
  ```

- API {#api}

  To encrypt data, use the [encrypt](../../api-ref/SymmetricCrypto/encrypt.md) REST API method for the [SymmetricCrypto](../../api-ref/SymmetricCrypto/index.md) resource or the [SymmetricCryptoService/Encrypt](../../api-ref/grpc/SymmetricCrypto/encrypt.md) gRPC API call.

{% endlist %}

## Decrypt data {#decryption}

{% note info %}

Changes caused by [eventually consistent operations](../../concepts/consistency.md) require up to three hours to become decryptable.

{% endnote %}

{% list tabs group=instructions %}

- CLI {#cli}

  This command will decrypt the ciphertext provided in `--ciphertext-file` and write the resulting plain text to `--plaintext-file`:

  * `--id`: ID of the [KMS key](../../concepts/key.md). Make sure you set either the `--id` or `--name` flag.
  * `--name`: Name of the KMS key. Make sure you set either the `--id` or `--name` flag.
  * `--ciphertext-file`: Input plaintext file.
  * `--aad-context-file` (optional): Input file with [AAD context](../../concepts/symmetric-encryption.md#add-context).
  * `--plaintext-file`: Output file with ciphertext.

  ```bash
  yc kms symmetric-crypto decrypt \
    --id abj76v82fics******** \
    --ciphertext-file ciphertext-file \
    --plaintext-file decrypted-file
  ```

- API {#api}

  To decrypt data, use the [decrypt](../../api-ref/SymmetricCrypto/decrypt.md) REST API method for the [SymmetricCrypto](../../api-ref/SymmetricCrypto/index.md) resource or the [SymmetricCryptoService/Decrypt](../../api-ref/grpc/SymmetricCrypto/decrypt.md) gRPC API call.

{% endlist %}

#### See also {#see-also}

* [Command line interface CLI](../../../cli/index.md).
* [Symmetric encryption in Yandex Key Management Service](../../concepts/symmetric-encryption.md).
* [Asymmetric encryption in Yandex Key Management Service](../../concepts/asymmetric-encryption.md).
* [Managing keys in Key Management Service](../../operations/index.md).