I would like to download some files from my server into my laptop, and the thing is that I want this communication to be as stealth and secure as it can be. So, far I came up using VPN, in that way I redirect the whole internet traffic of my laptop via my server. Additionally, I tried to send a file using ftp and observing Wireshark at the same time. The communication seems to be encrypted, however I would like also to encrypt the file itself (as a 2nd step security or something like that).

My server is a RasPi running Raspbian. My laptop is Macbook Air.

I want firstly to encrypt a file in my Ras Pi and secondly download it. How can I do that?

  • 1
    gpg can encrypt files, either asymmetrically (using a public key for encryption and a private key for decryption) or symmetrically (using the same key/password for encryption and decryption: dewinter.com/gnupg_howto/english/GPGMiniHowto.html Oct 19, 2014 at 9:54
  • Why not use a protocol such as HTTPS, SFTP or FTPS? If the communication is encrypted, adding a second layer of encryption won't gain you anything. Oct 19, 2014 at 13:07
  • Encryption at rest is standard required security practice for sensitive files such as medical or financial data. It protects data not actively in use against file system compromise. Jul 24, 2020 at 15:21
  • Please stop using FTP. Yes, using a point-to-point vpn compensates for most of FTPs faults, but there are lots of better solutions. The world has moved on. So should you.
    – symcbean
    Sep 27, 2021 at 21:01

3 Answers 3


You can use openssl to encrypt and decrypt using key based symmetric ciphers. For example:

openssl enc -in foo.bar \
    -aes-256-cbc \
    -pass stdin > foo.bar.enc

This encrypts foo.bar to foo.bar.enc (you can use the -out switch to specify the output file, instead of redirecting stdout as above) using a 256 bit AES cipher in CBC mode. There are various other ciphers available (see man enc). The command will then wait for you to enter a password and use that to generate an appropriate key. You can see the key with -p or use your own in place of a password with -K (actually it is slightly more complicated than that since an initialization vector or source is needed, see man enc again). If you use a password, you can use the same password to decrypt, you do not need to look at or keep the generated key.

To decrypt this:

openssl enc -in foo.bar.enc \
    -d -aes-256-cbc \
    -pass stdin > foo.bar

Notice the -d. See also man openssl.

  • 1
    Also, you can output the result to a file using the option -out FILENAME rather than piping in the output.
    – crazyGuy
    Nov 14, 2017 at 10:25
  • nowadays (openssl 1.1.1l on Ubuntu), it seems that: 1. it is a good idea to add -pbkdf2 and 2. it is better to leave out -pass stdin: with -pass stdin, on my system the passphrase is shown in plain text; without it, openssl asks "enter aes-256-cbc encryption password:", which then can be entered without showing up.
    – Pierre D
    Sep 27, 2021 at 19:03

For one-off cases you can encrypt using zip and a password. While not as strong as key based techniques (because it is hard to have a good password) it is probably fine ad-hoc situations.

Command line looks like this:

zip -r -0 -e encrypted_file.zip /path/to/files

-r to recurse directories.
-e to encrypt
  • to open the file: unzip encrypted_file.zip
    – shem
    Jul 17, 2020 at 5:58

Slight mods to @goldilocks answer:


openssl enc -in foo -aes-256-cbc -pbkdf2 -out foo.enc


  1. By leaving out the -pass stdin args, this will prompt "enter aes-256-cbc encryption password:" and let you type the passphrase without showing in your console;
  2. It will use the PBKDF2 algorithm with default iterations, and suppress the warning "*** WARNING : deprecated key derivation used. Using -iter or -pbkdf2 would be better."


openssl enc -d -in foo.enc -aes-256-cbc -pbkdf2 -out foo.plain

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.