> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nebius.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting started with Key Management Service: Use symmetric keys for encryption

Key Management Service (KMS) lets you create symmetric keys that use the same key material for encryption and decryption. The example below shows how to create your first symmetric key, encrypt sample data and decrypt it.

## Prerequisites

You can create symmetric keys in any Nebius AI Cloud interface, but to encrypt and decrypt data, use the Nebius AI Cloud CLI.

1. [Install and configure](/cli/install) the Nebius AI Cloud CLI.
2. Make sure you are in a [group](/iam/authorization/groups/index) that has at least the `editor` role within your tenant or project; for example, the default `editors` group. You can check this in the [Administration → IAM](https://console.nebius.com/iam) section of the web console.

## Steps

### Create a symmetric key

<Tabs>
  <Tab title="Web console">
    1. In the [web console](https://console.nebius.com), go to <Icon icon="https://mintcdn.com/nebius-ai-cloud/BhI64Dlym_yJl7Yy/_assets/sidebar/cryptography.svg?fit=max&auto=format&n=BhI64Dlym_yJl7Yy&q=85&s=e2af8c31917650f2951761ab265dd9b9" width="14" height="16" data-path="_assets/sidebar/cryptography.svg" /> **Cryptography** → **KMS**.

    2. Click <Icon icon="https://mintcdn.com/nebius-ai-cloud/1Ha0sWR6e1mnIaHS/_assets/plus.svg?fit=max&auto=format&n=1Ha0sWR6e1mnIaHS&q=85&s=7c9efc69d65fc58db0eb73702fd81aa1" width="16" height="16" data-path="_assets/plus.svg" /> **Create key**.

    3. On the key creation page:

       * In the **Name** field, enter `my-symmetric-key`.
       * In the **Type** field, preserve **Symmetric key**.

    4. Click **Create key**.

    This creates a symmetric key with the `AES_256_GCM` algorithm and the default rotation period of three months.

    You need the key ID to encrypt and decrypt data. In the list of symmetric keys, click <Icon icon="https://mintcdn.com/nebius-ai-cloud/1Ha0sWR6e1mnIaHS/_assets/copy.svg?fit=max&auto=format&n=1Ha0sWR6e1mnIaHS&q=85&s=e7f23591f2e46ebae45634aa995aaa9f" width="16" height="16" data-path="_assets/copy.svg" /> next to the key ID of the key you created, then save the copied value to the `KEY_ID` environment variable:

    ```bash theme={null}
    export KEY_ID=<key_ID>
    ```
  </Tab>

  <Tab title="CLI">
    Create a symmetric key:

    ```bash theme={null}
    export KEY_ID=$(nebius kms symmetric-key create \
      --name my-symmetric-key \
      --algorithm aes_256 \
      --format jsonpath='{.metadata.id}')
    ```

    This command includes the following parameters:

    * `--name`: Name of the symmetric key.
    * `--algorithm`: [Encryption algorithm](/kms/types-operations#encryption-algorithms) that the key uses. For symmetric keys, KMS only supports the `aes_256` algorithm.
    * `--format jsonpath='{.metadata.id}'`: Returns only the key ID from the command output.

    This command creates a symmetric key with the default rotation period of three months and saves the key ID to the `KEY_ID` environment variable.
  </Tab>
</Tabs>

### Encrypt data

1. Encode the text `Hello world` in Base64:

   <CodeGroup>
     ```bash Ubuntu theme={null}
     printf '%s' 'Hello world' | base64 -w 0
     ```

     ```bash macOS theme={null}
     printf '%s' 'Hello world' | base64
     ```
   </CodeGroup>

   The output looks like the following:

   ```text theme={null}
   SGVsbG8gd29ybGQ=
   ```

2. Encrypt the text `Hello world`:

   ```bash theme={null}
   nebius kms symmetric-crypto encrypt \
     --key-id "$KEY_ID" \
     --plaintext SGVsbG8gd29ybGQ=
   ```

   This command includes the following parameters:

   * `--key-id`: ID of the symmetric key that you created.
   * `--plaintext`: Base64-encoded value of your text.

   The command returns the `ciphertext` value that you need for decrypting the data later:

   ```yaml theme={null}
   key_id: kmssymkey-e00***
   ciphertext: AhIClM3o***
   ```

### Decrypt data

1. To decrypt the data, use the same symmetric key and the returned ciphertext:

   ```bash theme={null}
   nebius kms symmetric-crypto decrypt \
     --key-id "$KEY_ID" \
     --ciphertext <ciphertext>
   ```

   This command includes the following parameters:

   * `--key-id`: ID of the symmetric key that you created.
   * `--ciphertext`: Ciphertext returned when you encrypted the plaintext.

   The output contains the Base64-encoded plaintext:

   ```yaml theme={null}
   key_id: kmssymkey-e00***
   plaintext: SGVsbG8gd29ybGQ=
   ```

2. Decode the `plaintext` value from Base64:

   ```bash theme={null}
   printf '%s' 'SGVsbG8gd29ybGQ=' | base64 -d
   ```

   The output is:

   ```text theme={null}
   Hello world
   ```

## What's next

* Learn [how to rotate a symmetric key manually](/kms/manage/rotate)
* Learn how to encrypt larger volumes of data with [envelope encryption](/kms/cryptography/symmetric#how-to-use-envelope-encryption)