Skip to content
Free public beta until December 4, 2026: every course is open, no card needed. After that, the first chapter of each course stays free and full access is a one-time $39 ($19 for up to 100 founding members chosen for helpful feedback). Your progress is kept. How the beta works

NVS encryption

ESP-IDF scrambling the stored-settings partition with a key the chip protects.

NVS encryption encrypts the NVS partition with AES-XTS, keyed from a flash-encryption-protected partition or an eFuse HMAC key; it hides values from a flash dump but not from running firmware, and has no integrity tag.

Examples

  • With NVS encryption on, a flash dump of a bench node shows its stored credential only as scrambled bytes.

  • The NVS keys come from an eFuse HMAC key or a protected nvs_keys partition, not from anything the attacker can read off the flash.

See also

digital-signature peripheral secure element eFuse
Read the full section →