How to Encrypt ODK Forms with a Public-Private Key Pair

ODK encrypted forms protect finalized submissions with a public key before upload. The server stores encrypted submissions, while the matching private key remains with the researcher for decryption.

Use the ODK encryption and key management checklist to choose an encryption model, test exports, and document recovery before fieldwork.

Last updated: August 13, 2026.

Choose the encryption model

ODK Central supports managed encryption and self-supplied keys. Managed encryption is usually simpler because Central protects the key with a passphrase. Self-supplied keys give the research team direct custody of the private key and require careful key storage.

For self-supplied keys, use the SurveyLoopr ODK encryption key generator. The generator runs locally in the browser and never uploads the private key.

Generate and store the keys

1. Open the ODK encryption key generator.
2. Generate the keypair and download both PEM files.
3. Store the private key in an encrypted password manager or secure offline location.
4. Keep the private key for every published form version.

SurveyLoopr cannot recover a lost private key. A new key cannot decrypt submissions encrypted with an older public key.

Add the public key to the XLSForm

Open the settings sheet and add a public_key column. Paste the ODK-ready public-key value into the row for the form. The private key must never be included in the XLSForm.

The public key may be stored in the SurveyLoopr workbook because it cannot decrypt submissions. The SurveyLoopr workspace Encryption action can add the value to the settings sheet and retain public-key versions in workbook history.

Publish and collect data

Publish the form after reviewing the settings sheet. ODK Collect encrypts finalized form data and attachments before submission. Keep the matching private key separate from the device and server.

Decrypt submissions

Use ODK Briefcase with the matching private key to download and decrypt self-supplied encrypted submissions. Keep decrypted exports in an access-controlled location and delete temporary files according to the study retention plan.

Rotate keys safely

Key regeneration creates a new version. Keep the old private key because old submissions still require it. Do not overwrite or discard old private keys until every submission encrypted with the corresponding public key has been securely decrypted or the data is no longer needed.

Security reminders

• HTTPS protects data in transit but does not protect stored submissions from server compromise or privileged access.
• Encrypted forms do not remove unencrypted copies from devices before finalization.
• Restrict ODK Central users and App Users.
• Maintain secure backups and test restoration.
• Complete ethics, consent, retention, and legal review for sensitive studies.

Read the official ODK encrypted forms documentation and ODK Central encryption guidance for the underlying protocol and operational limitations.

Frequently asked questions

Does SurveyLoopr store the private key?

No. SurveyLoopr generates the private key in your browser and downloads it directly. The workspace stores only the public key, which cannot decrypt submissions.

What happens if the private key is lost?

Encrypted submissions cannot be decrypted without the matching private key. SurveyLoopr cannot recover it, so store every private key in an encrypted password manager or secure offline location.

Does HTTPS replace ODK encrypted forms?

No. HTTPS protects data while it travels between a device and server. Encrypted forms protect finalized submissions from being readable by the server or privileged infrastructure access.