Sharing sensitive credentials—like passwords, PINs, or API keys—via chat or email is a common habit, but it comes with a massive privacy risk if a device is lost or compromised. As developers, we constantly share environment variables and access tokens over Slack or WhatsApp out of convenience, often ignoring the security implications.
If you have ever wondered how to send passwords securely on WhatsApp without relying on a bulky password manager, you are not alone. CipherBite is designed to solve this exact problem.
Instead of sending plain text, CipherBite converts your sensitive information into unique, encrypted cipher text that can only be decoded through the app. I built this offline text encryption app to serve as the perfect middle ground between the convenience of quick messaging and the high-level security of dedicated tools.
Here is a deep dive into how I built it, the tech stack I chose, and the security architecture behind it.
🛠️ The Tech Stack
To build a high-performance, natively compiled application from a single codebase, I chose Flutter. For a security-focused app, maintaining a single codebase minimizes the surface area for bugs and vulnerabilities.
For state management, Riverpod is the backbone of CipherBite. It is compile-safe and seamlessly separates the UI from the heavy AES-256 encryption logic, ensuring the app reacts instantly to database changes—like restoring a vault from a backup—without requiring the user to restart the app.
🔒 Security First: "Never Roll Your Own Crypto"
When building an app to hide secret text in chat, I had to strictly adhere to the golden rule of cybersecurity: "Never roll your own crypto". Custom encryption algorithms are easily reverse-engineered.
That is why CipherBite is powered by industry-standard AES-256 encryption, ensuring your data is scrambled into completely secure, unreadable text. Furthermore, the app operates 100% offline, relying entirely on on-device computation without the need for a backend server. This means zero data collection and maximum privacy.
Users can also encrypt text message with PIN protection, adding an extra layer of security that requires a specific PIN to decode a secret message.
🗄️ Double-Layer Security with SQLCipher
Local storage is critical for a strictly offline, privacy-first application. To store the user's encryption history locally, I chose SQLite—specifically the SQLCipher implementation.
This creates a double-layer security architecture:
Text Level: The raw text is scrambled using AES-256.
Storage Level: The .db file saving that AES text is fully encrypted by SQLCipher.
Even if a device is rooted or compromised, the local vault ensures zero data leaks.
☁️ Secure Cloud Backups with Google Drive API
While the app is completely offline, users still need a way to back up their local vault. I integrated the Google Drive API to provide a seamless cloud backup solution.
I chose it specifically because of its unique appDataFolder scope. This scope creates a hidden, protected folder in the user's personal Google Drive. This ensures users have full control over their encrypted backups without the risk of accidentally tampering with or deleting the vault from their regular Drive interface.
🚀 Wrapping Up
Building CipherBite was an incredible journey in balancing frictionless UX with military-grade security. It acts as a lightweight, privacy-focused alternative to generic encryptors by focusing purely on securing standard messaging apps.
If you are interested in trying it out, CipherBite is now available on the Google Play Store!
I would love to hear your thoughts, feedback, or any questions about implementing SQLCipher and Google Drive API in Flutter.
Drop a comment below! 👇
Top comments (0)