---
title: Create and manage a Key Manager data encryption key
description: Discover how to create a data encryption key from the Scaleway console to encrypt and decrypt your payloads using Scaleway's Key Manager.
tags: key-manager data-encryption-key data key payload encryption
dates:
  validation: 2025-08-28
  posted: 2025-02-06
---
import Requirements from '@macros/iam/requirements.mdx'
import KeyManagerPlaintextVsCiphertext from '@macros/key-manager/plaintext-vs-ciphertext.mdx'


Scaleway's key Manager allows you to create [data encryption keys (DEK)](/key-manager/concepts/#data-encryption-key-dek) to encrypt and decrypt your [payload](/key-manager/concepts/#payload).

You can then use your Key Manager key to encrypt your DEK.

    <Message type="important">
     You are responsible for storing your DEKS, as Key Manager does not store them for you.
    </Message>

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- [Created](/key-manager/how-to/create-km-key/) a Key Manager key

## How to create and manage a data encryption key (DEK)

1. Click Key Manager in the **Security & Identity** section of the [Scaleway console](https://console.scaleway.com) side menu. Your keys display.
2. Click the key for which to create a data encryption key.
3. Scroll down to the **Create data encryption key** section.
4. Click **Create data encryption key**. A pop-up displays with the [ciphertext](/key-manager/concepts/#ciphertext) of your DEK.
5. Copy and store your DEK's ciphertext safely.
    <Message type="important">
     - We recommend that you **always store the ciphertext** of your data encryption key rather than its [plaintext](/key-manager/concepts/#plaintext).
     - While Scaleway Key Manager is responsible for generating, encrypting, and decrypting data encryption keys, it does not store, manage, or monitor them, nor does it engage in cryptographic operations with these keys. **You must use and manage data encryption keys outside of Key Manager**.
     - Read our [documentation](/key-manager/reference-content/understanding-key-manager/) to understand Key Manager.
    </Message>
6. Optionally, click **Display plaintext** to make sure that the plaintext does not contain any mistakes.
    <KeyManagerPlaintextVsCiphertext />
7. Click **Close**.