# pg\_vault\_tde v1.7.1 : Transparent Data Encryption for PostgreSQL 17 and 18

DevFeed: [pg\_vault\_tde v1.7.1 : Transparent Data Encryption for PostgreSQL 17 and 18](<https://devfeed.tech/articles/pg-vault-tde-v1-7-1-transparent-data-encryption-for-postgresql-17-and-18-4719.md>)

Original publisher: [Read original article](<https://www.postgresql.org/about/news/pg_vault_tde-v171-transparent-data-encryption-for-postgresql-17-and-18-3376/>)

Author: Miriade Srl

Published: 2026-09-10T00:00:00Z

Content type: release

Language: en

Sources: [PostgreSQL news](<https://devfeed.tech/sources/postgresql-news.md>)

Topics: [Encryption](<https://devfeed.tech/topics/encryption.md>), [Database](<https://devfeed.tech/topics/database.md>), [Cryptography](<https://devfeed.tech/topics/cryptography.md>)

Tags: [database](<https://devfeed.tech/tags/database.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [postgresql](<https://devfeed.tech/tags/postgresql.md>), [release](<https://devfeed.tech/tags/release.md>)

## AI overview

pg_vault_tde 1.7.1 adds transparent AES-256-GCM encryption for PostgreSQL 17 and 18, with externally managed keys and online per-table key rotation. It fixes AAD derivation for out-of-line TOAST values; data written by 1.7.0 or earlier must be exported before upgrading affected tables.

## Source excerpt

pg_vault_tde provides Transparent Data Encryption for PostgreSQL 17 and 18. A table access method, encrypted_heap, encrypts every tuple with AES-256-GCM before it reaches the storage manager and decrypts it after it leaves, so applications require no changes. Keys are held outside the database: HashiCorp Vault or OpenBao through the Transit engine, a PKCS#11 token or HSM, or a local PKCS#12 wallet. Data encryption keys are per table and can be rotated online. Requirements are PostgreSQL 17 or 18, OpenSSL 3.x, and the library listed in shared_preload_libraries. The current release is 1.7.1. It corrects the AAD derivation for out-of-line TOAST values, with the consequence that TOAST data written by 1.7.0 or earlier does not authenticate under 1.7.1: affected tables must be exported before the new binary is installed. The procedure is documented in the README. pg_vault_tde is released under the PostgreSQL licence. Sources, documentation and binary .deb and .rpm packages are on GitHub; the distribution is on PGXN.