ODK security utility

Generate ODK encryption keys locally.

Create an ODK-compatible RSA keypair in your browser, download both files, and keep the private key under your control.

Works offline after this page loads. Last updated: August 13, 2026.

Generate an ODK encryption keypair

Runs locally in your browser. No key material is uploaded.

Public key

Add this to the XLSForm settings sheet as `public_key`.

Private key

Download and store securely. SurveyLoopr cannot recover it.

Keep the matching private key for every published encrypted form version. A new key cannot decrypt submissions encrypted with an older public key.

How the ODK keypair works

ODK encrypted forms use asymmetric encryption. The public key encrypts finalized form data, while the matching private key is required for decryption.

  1. Generate and download both keys.
  2. Store the private key in an encrypted password manager or secure offline location.
  3. Copy the ODK-ready public-key value into the XLSForm settings sheet.
  4. Publish the form and retain the matching private key for future exports.

Read the complete guide to encrypting ODK forms or configure the public key directly in the SurveyLoopr XLSForm workspace.

ODK encryption key FAQ

Does SurveyLoopr receive the private key?

No. The keypair is generated locally in your browser. SurveyLoopr downloads the private key directly to your device and stores only the public key when you use the workspace integration.

Which key goes into an XLSForm?

The public key goes into the settings sheet in the public_key field. The private key must stay outside the form and is needed later to decrypt encrypted submissions with ODK Briefcase.

Can I regenerate an ODK encryption key?

Yes, but regeneration creates a new key version. Keep every matching private key because a new private key cannot decrypt submissions that were encrypted with an earlier public key.