End-to-end encryption

With end-to-end encryption, the title, message, url and url_title fields are encrypted in your system and decrypted only on devices that have the key. PushBell never sees these fields; queueing, delivery and the inbox work with the ciphertext.

1. Create the key

In the PushBell app: Settings → End-to-end encryption → Generate a new key. Copy the 64-character (256-bit, hexadecimal) key and:

• put it in your sending system (server, script),
• enter the same key on your other devices with Enter a key.

The key stays on your devices only. If you lose it, encrypted notifications cannot be read.

2. Encrypt the fields

Each field is encrypted on its own:

1. GZIP-compress the text.
2. Generate a random 16-byte IV.
3. Encrypt with AES-256-CBC (PKCS7 padding) using the key and the IV.
4. Compute HMAC-SHA256 over IV ‖ ciphertext with the same key.
5. Base64-encode IV ‖ ciphertext ‖ HMAC; that is the field value.

This is the same format as Pushover’s: code written for Pushover works unchanged.

#!/bin/sh
KEY="your-64-character-key"
encrypt() {
  IV=$(openssl rand -hex 16)
  CT=$(printf '%s' "$1" | gzip -9 | openssl enc -aes-256-cbc -K "$KEY" -iv "$IV" | xxd -p | tr -d '\n')
  HMAC=$(printf '%s' "${IV}${CT}" | xxd -r -p | openssl dgst -sha256 -mac HMAC -macopt hexkey:"$KEY" | awk '{print $NF}')
  printf '%s' "${IV}${CT}${HMAC}" | xxd -r -p | openssl base64 -A
}

curl https://api.pushbell.app/v1/messages \
  -H "Authorization: Bearer pb_live_…" \
  -H "Content-Type: application/json" \
  -d "{\"title\":\"$(encrypt 'New order')\",\"message\":\"$(encrypt '$42.00, Jane D.')\",\"encrypted\":true}"

3. Send

Send with encrypted: true (encrypted=1 on the Pushover-compatible endpoint).

• message is required; the notification type’s title and body templates are not applied to encrypted messages.
• Length limits apply to the ciphertext (title 1,024, message 8,000 characters).
• If the text does not fit in the 4 KB push payload it is left out of the notification and decrypted in full when opened in the app.
• On a device without the key the notification shows as 🔒 Encrypted notification; once the key is entered, older inbox items open too.