FileMaker file encryption protects a custom app while its database files are stored on disk. It is therefore commonly described as encryption at rest, or EAR.
An encrypted FileMaker file cannot be opened or examined without its encryption password, even if someone obtains a physical copy of the .fmp12 file.
File encryption is different from user accounts and passwords. FileMaker accounts determine what an authenticated user may do inside a custom app. Encryption protects the file itself if it is copied, stolen, downloaded from a server, or recovered from a storage device.
What risk does FileMaker encryption protect against?
Without file encryption, a person who gains access to a database file may attempt to open it, analyze it, recover information from it, or use specialized tools to bypass parts of its normal access controls.
File encryption helps protect against situations such as:
- Theft of a computer or storage device
- Unauthorized access to a server disk
- Accidental exposure of a database backup
- Copying of an
.fmp12file by an unauthorized person - Loss or theft of removable storage
- Unauthorized access to files recovered from retired hardware
Encryption also applies to temporary files created by the encrypted database.
It does not replace FileMaker accounts, privilege sets and extended privileges, external authentication, SSL certificates, or a properly secured server.
These mechanisms protect different parts of the system:
- File encryption protects stored database files.
- FileMaker accounts and privilege sets control access inside the custom app.
- External authentication verifies users through an identity provider.
- SSL/TLS encrypts data while it travels between FileMaker Server and its clients.
How do you encrypt a FileMaker file?
FileMaker files are encrypted using the Developer Utilities included with FileMaker Pro.
The advanced tools must first be enabled in FileMaker Pro settings. You can then:
- Close the FileMaker files that you want to encrypt.
- Choose Tools > Developer Utilities.
- Add the relevant
.fmp12files. - Select a destination folder.
- Open Solution Options.
- Select Enable Database Encryption.
- Enter the credentials of a FileMaker account with Full Access.
- Define an encryption password and password hint.
- Create the encrypted copy.
Developer Utilities creates a new encrypted copy. It does not encrypt the original file in place. The resulting files should therefore be tested before replacing the production version.
For a multifile custom app, all related files should be encrypted together using the same encryption password and shared ID. Otherwise, users may be asked for additional encryption passwords when one file attempts to communicate with another.
The same Developer Utilities can later be used to re-encrypt the file with another password or remove encryption, but the current encryption password is always required.
The encryption password is not a FileMaker account password
The encryption password is completely separate from the account name and password used to sign in to the custom app.
A user may know their FileMaker login and still be unable to open a physical copy of the encrypted file. Conversely, knowing the encryption password does not provide a valid FileMaker user account or grant access to records and layouts.
The encryption password is normally entered by the developer or server administrator, not by every user.
See Which Password Should I Use with fmcloud.fm? for a complete explanation of the different credentials involved.
What happens if the encryption password is lost?
An encryption password cannot be recovered.
Claris cannot retrieve it, and fmcloud.fm cannot reset it or bypass it. If every copy of the password is lost, the encrypted database and its encrypted backups may become permanently inaccessible.
The password should therefore be:
- Long and unique
- Stored in a reliable password manager
- Available to more than one authorized person
- Included in the organization’s recovery documentation
- Backed up through a secure escrow or emergency-access procedure
It should not exist only in one developer’s memory, personal notes, or password-manager account.
A password hint may help identify the correct password, but it should never reveal enough information to let someone guess it.
Saving the encryption password on FileMaker Server
When FileMaker Server opens an encrypted database, the server administrator must provide the encryption password.
Admin Console offers a Save Password option. When selected, FileMaker Server stores the password in its encrypted cache. This allows the database to open automatically when FileMaker Server starts and the option to open databases automatically is enabled.
Saving the password on the server does not remove encryption from the file. A copy downloaded from the server remains encrypted.
The saved password can later be cleared from Admin Console. Clearing it removes the password from the server cache but does not modify the database file or its encryption settings.
What happens if the password is not saved on the server?
An encrypted database can be hosted without saving its encryption password. However, it cannot reopen automatically without someone entering that password.
This becomes particularly important after:
- A FileMaker Server restart
- A server operating-system restart
- A FileMaker Server upgrade
- A server migration
- Maintenance requiring databases to be closed and reopened
- A power failure or unexpected interruption
Until an administrator manually enters the encryption password, the file remains closed and unavailable to FileMaker Pro, FileMaker Go, WebDirect, Data API, OData, ODBC/JDBC and other clients.
For most production servers, we therefore recommend saving the encryption password in FileMaker Server’s encrypted cache while also preserving an independent copy in a secure password-management system.
Encryption and external container data
Container data stored externally can use either open storage or secure storage.
When Developer Utilities encrypts a FileMaker file, it uses secure storage for externally stored container data by default. The Keep Open Storage option may be selected if the external files must remain in their original readable format.
Secure external container storage and database encryption are related, but they are not exactly the same feature. Learn more in What Is FileMaker Secure Container Storage?.
Encryption and backups
A backup of an encrypted FileMaker database remains encrypted. Anyone restoring or downloading that backup will still need the encryption password.
At fmcloud.fm, local backups are complemented by nightly encrypted backups transferred to separate S3-compatible storage. This externalization is included with every hosting plan.
The native FileMaker Server Remote Backup service can also provide end-to-end encrypted remote copies when Encryption at Rest is enabled for the hosted databases.
Encryption remains useful even when the backup storage itself is protected. It provides an additional layer of security if an individual database file or backup copy is exposed.
See the fmcloud.fm security policy for more information about backup encryption and infrastructure security.
Learn more
- Claris: Encrypting and decrypting database files
- Claris Security Guide: Encrypt a custom app
- Claris: Clearing a saved database encryption password
- What Are FileMaker Privilege Sets and Extended Privileges?
- What Is External Authentication in FileMaker?
- What Is FileMaker Server Remote Backup?
- fmcloud.fm Security Policy
