SQLCipher 5.0.0-beta

2026-09-15 08:00:00 -0400

We are pleased to announce the immediate availability of SQLCipher 5.0.0-beta. Many of the features in this beta have been under development for over a year and we are excited to share them with the SQLCipher community for testing.

WARNING: This should only be used for beta testing at this time, not in production. It includes major functional, API, and behavioral changes that are NOT COMPATIBLE with SQLCipher 4 and earlier by default.

This is a major update that includes the following architectural improvements, security enhancements, new functionality, and other changes:

VFS Architecture

The most significant update in the new version is the replacement of the legacy CODEC hook with SQLite Virtual Filesystem (VFS) shims. VFS allows SQLCipher to transparently intercept file I/O for encryption and decryption using public SQLite APIs. As a result of this redesign, many files previously modified by SQLCipher have been reverted to unmodified upstream SQLite sources.

AEAD Encryption (AES-256-GCM)

Authenticated Encryption with Associated Data (AEAD) using AES-256-GCM is the new default, replacing the previous AES-256-CBC + HMAC-SHA512 design. This addresses one of SQLCipher’s most requested security improvements. GCM provides a modern, standard, and widely implemented authenticated encryption mode. It improves SQLCipher’s design by replacing the previously separate encryption and MAC steps.

KDF Iteration Changes

The default iteration count for PBKDF2-HMAC-SHA512 is now 512K (up from 256K). While the previous default meets the OWASP recommendation of 220K iterations, this increase provides a larger margin and should remain a reasonable SQLCipher 5 default for many years to come.

Default Page Size

The default database page size is now 8192 bytes (up from 4096). Switching to an 8K page size reduces per-page encryption overhead and performs well for both bulk operations and smaller statements.

PRAGMA rekey for Encryption/Decryption

We’ve expanded PRAGMA rekey to convert plaintext databases to encrypted, and vice versa. This greatly simplifies the process for converting unsecured applications to use SQLCipher while preserving existing data. To encrypt an existing plaintext database, open the database as normal and then set a key:

sqlite3 plaintext.db
PRAGMA rekey = 'YourKeyGoesHere';

Other Potentially Breaking Changes

Historically deprecated PRAGMA settings are removed: cipher_store_pass, cipher, fast_kdf_iter, cipher_hmac_pgno, cipher_hmac_salt_mask, rekey_cipher, and rekey_kdf_iter
SQLCipher is now built at compile time by default (it is no longer necessary to define SQLITE_HAS_CODEC)
The sqlcipher_provider interface has been expanded with AEAD and KBKDF functions that must be implemented in custom cryptographic providers
The CommonCrypto provider is now deprecated and requires a special override define to compile (GCM is not available through the public API)
Keying :memory: databases is now an explicit misuse error
Compile-time macros -DSQLITE_USE_URI and -DSQLITE_DIRECT_OVERFLOW_READ=0 are now required
Internal function names in sqlcipher.h have been renamed as part of the VFS redesign (not part of the SQLite API)

Compatibility and Migration

The default v5 database settings are not backwards-compatible with SQLCipher 4 databases. Application code changes are required to take advantage of the new defaults. To open or migrate existing databases, the following options are available:

Migrate existing databases in place (preserving data and schema) with PRAGMA cipher_migrate.
Open older databases without migrating using PRAGMA cipher_compatibility to adjust settings back to their previous values. For example, to open a SQLCipher 4 database using 5.0.0-beta:
```
PRAGMA key = 'YourKeyGoesHere';
PRAGMA cipher_compatibility = 4;
```
Set a default compatibility level for an entire process using PRAGMA cipher_default_compatibility. All attached databases inherit this setting. For example, to set the process default before opening any encrypted databases:
```
PRAGMA cipher_default_compatibility = 4;
PRAGMA key = 'YourKeyGoesHere';
```
Convert plaintext databases to an encrypted database using the new PRAGMA rekey support described above.

Availability

SQLCipher 5.0.0-beta is available for download starting today, separate from the existing SQLCipher 4 releases, so you can begin testing in parallel with your current deployment.

Commercial and Enterprise - Your organization will find the new beta packages on the “Prerelease” tab of the Customer Downloads fulfillment site. Don’t forget to update the license code in your application(s) when you upgrade!

Community Edition - The source for SQLCipher 5.0.0-beta is available at the main repository beta tag on GitHub. SQLCipher for Apple is available from the SQLCipher.swift beta tag. SQLCipher for Android is available as source or a downloadable AAR package from the SQLCipher Android beta tag.

Feedback

We recommend testing this beta thoroughly to prepare applications and identify potential upgrade issues. For the time being, please direct feedback and questions to support@zetetic.net so all beta issues are reported in one place. We appreciate your help validating SQLCipher 5.0.0-beta in advance of an official release at a later date!