---
title: "Preface"
---

Each project in Infisical can be used either in **End-to-End Encrypted (E2EE)** mode or **Encrypted Standard (ES)** mode which dictates how it can be interacted with via the Infisical API.

<CardGroup cols={2}>
  <Card
    title="Encrypted Standard (ES)"
    href="/api-reference/overview/encryption-modes/es-mode"
    icon="shield-halved"
    color="#3c8639"
  >
    Secret operations without client-side encryption/decryption
  </Card>
  <Card href="/api-reference/overview/encryption-modes/e2ee-mode" title="End-to-End Encrypted (E2EE)" icon="shield" color="#3775a9">
    Secret operations with client-side encryption/decryption
  </Card>
</CardGroup>

By default, all projects are initialized in **E2EE** mode which means the server is not able to decrypt any values because all secret encryption/decryption operations occur on the client-side. However, this has limitations around functionality and ease-of-use:

- You cannot make HTTP calls to Infisical to read/write secrets in plaintext.
- You cannot leverage non-E2EE features like native integrations and in-platform automations like dynamic secrets and secret rotation.

For this reason, Infisical also provides the **ES** mode of operation to unlock the above limitations by enabling the server to decrypt your values. You can optionally switch a project to using **ES** mode
in your Project Settings.

<Note>
    Make no mistake, the limitations of **E2EE** mode do not prevent you from syncing secrets from Infisical to platforms like GitLab. They just imply
    that you have to do things the "E2EE-way" such as by embedding the Infisical CLI into your GitLab CI/CD pipelines to fetch and decrypt
    secrets on the client-side.
</Note>

## FAQ

<AccordionGroup>
  <Accordion title="Is E2EE mode or ES mode right for me?">
    We recommend starting with **E2EE** mode and switching to **ES** mode when:
    
    - Your team needs more power out of non-E2EE features available in **ES** mode such as secret rotation, dynamic secrets, etc.
    - Your team wants an easier way to read/write secrets with Infisical.

  </Accordion>
  <Accordion title="How can I switch from E2EE mode to ES mode?">
    By default, all projects in Infisical are initialized to **E2EE** mode and can be switched to **ES** mode in the Project Settings by disabling end-to-end encryption.
  </Accordion>
  <Accordion title="Is ES mode secure if it's not E2EE?">
    **ES** mode is secure and in fact what most vendors in the secret management industry are doing at the moment. In this mode, secrets are encrypted at rest by
    a series of keys, secured ultimately by a top-level `ROOT_ENCRYPTION_KEY` located on the server.

    If you're concerned about Infisical Cloud's ability to read your secrets if using **ES** mode in Infisical Cloud, then you may wish to
    use Infisical Cloud in **E2EE** mode or self-host Infisical on your own infrastructure and then use **ES** mode; this of course which means setting up firewalls and securing the instance yourself.

    As an organization, we prohibit reading any customer secrets without explicit permission; access to the `ROOT_ENCRYPTION_KEY` is restricted to one individual in the organization.
  </Accordion>
</AccordionGroup>