Security & Encryption
AES-256-CBC + HMAC-SHA256 at rest Free & Pro
Security & Encryption: what it does
Most SMTP plugins store API keys and OAuth tokens in wp_options — readable by any plugin, any admin, any SQL dump. NimblyMail applies authenticated encryption (AES-256-CBC with HMAC-SHA256, Encrypt-then-MAC) to every credential, derives encryption keys from your WordPress salts, and lets you override any setting via PHP constants for true 12-factor deploys.
What you get with Security & Encryption
Authenticated encryption
Encrypt-then-MAC on every API key and OAuth token — tampering is detected, not just hidden.
Salt-derived keys
Encryption keys derive from your WordPress salts; nothing secret ships in the plugin.
PHP-constant overrides
Define credentials in wp-config.php and keep secrets out of the database entirely.
Safe by default
Tokens never appear in logs, exports, or admin screens — the SMTP transcript redacts auth commands.
Three steps, zero babysitting
Enter credentials once
In wp-admin or as PHP constants — either way they're encrypted or never stored at all.
NimblyMail encrypts at rest
AES-256-CBC + HMAC-SHA256 with salt-derived keys, transparently.
Deploy with confidence
Database dumps, backups, and staging copies never expose usable credentials.
Security & Encryption questions, answered
No. Every credential is encrypted with AES-256-CBC and authenticated with HMAC-SHA256 before it touches wp_options. For maximum hygiene, define credentials as PHP constants and they're never stored at all.
Encrypted credentials are useless without your WordPress salts (which live in wp-config.php, not the database). A database-only dump exposes no working keys or tokens.
Yes — access and refresh tokens are encrypted identically, and NimblyMail refreshes them automatically so they never expire mid-send.
Related features
View all featuresEmail Notification Controls Free & Pro
Silence noisy WordPress emails. Keep transactional mail.
WordPress email has a noise problem: comment notifications, auto-update receipts, and admin confirmations bury the messages that matter. NimblyMail ships…
Learn moreMultisite & Network Admin Free & Pro
Network-wide defaults. Per-site overrides. Field locks.
Managing email across a multisite network usually means configuring SMTP on every site. NimblyMail gives network admins network-wide defaults, per-site…
Learn more