diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..ba7202bc
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,257 @@
+# Security Guide for Termix
+
+## Database Encryption
+
+Termix implements AES-256-GCM encryption for sensitive data stored in the database. This protects SSH credentials, passwords, and authentication tokens from unauthorized access.
+
+### Encrypted Fields
+
+The following database fields are automatically encrypted:
+
+**Users Table:**
+- `password_hash` - User password hashes
+- `client_secret` - OIDC client secrets
+- `totp_secret` - 2FA authentication seeds
+- `totp_backup_codes` - 2FA backup codes
+
+**SSH Data Table:**
+- `password` - SSH connection passwords
+- `key` - SSH private keys
+- `keyPassword` - SSH private key passphrases
+
+**SSH Credentials Table:**
+- `password` - Stored SSH passwords
+- `privateKey` - SSH private keys
+- `keyPassword` - SSH private key passphrases
+
+### Configuration
+
+#### Required Environment Variables
+
+```bash
+# Encryption master key (REQUIRED)
+DB_ENCRYPTION_KEY=your-very-strong-encryption-key-32-chars-minimum
+```
+
+**⚠️ CRITICAL:** The encryption key must be:
+- At least 16 characters long (32+ recommended)
+- Cryptographically random
+- Unique per installation
+- Safely backed up
+
+#### Optional Settings
+
+```bash
+# Enable/disable encryption (default: true)
+ENCRYPTION_ENABLED=true
+
+# Reject unencrypted data (default: false)
+FORCE_ENCRYPTION=false
+
+# Auto-encrypt legacy data (default: true)
+MIGRATE_ON_ACCESS=true
+```
+
+### Initial Setup
+
+#### 1. Generate Encryption Key
+
+```bash
+# Generate a secure random key (Linux/macOS)
+openssl rand -hex 32
+
+# Or using Node.js
+node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+```
+
+#### 2. Set Environment Variable
+
+```bash
+# Add to your .env file
+echo "DB_ENCRYPTION_KEY=$(openssl rand -hex 32)" >> .env
+```
+
+#### 3. Validate Configuration
+
+```bash
+# Test encryption setup
+npm run test:encryption
+```
+
+### Migration from Unencrypted Database
+
+If you have an existing Termix installation with unencrypted data:
+
+#### 1. Backup Your Database
+
+```bash
+# Create backup before migration
+cp ./db/data/db.sqlite ./db/data/db-backup-$(date +%Y%m%d-%H%M%S).sqlite
+```
+
+#### 2. Run Migration
+
+```bash
+# Set encryption key
+export DB_ENCRYPTION_KEY="your-secure-key-here"
+
+# Test migration (dry run)
+npm run migrate:encryption -- --dry-run
+
+# Run actual migration
+npm run migrate:encryption
+```
+
+#### 3. Verify Migration
+
+```bash
+# Check encryption status
+curl http://localhost:8081/encryption/status
+
+# Test application functionality
+npm run test:encryption production
+```
+
+### Security Best Practices
+
+#### Key Management
+
+1. **Generate unique keys** for each installation
+2. **Store keys securely** (use environment variables, not config files)
+3. **Backup keys safely** (encrypted backups in secure locations)
+4. **Rotate keys periodically** (implement key rotation schedule)
+
+#### Deployment Security
+
+```bash
+# Production Docker example
+docker run -d \
+  -e DB_ENCRYPTION_KEY="$(cat /secure/location/encryption.key)" \
+  -e ENCRYPTION_ENABLED=true \
+  -e FORCE_ENCRYPTION=true \
+  -v termix-data:/app/data \
+  ghcr.io/lukegus/termix:latest
+```
+
+#### File System Protection
+
+```bash
+# Secure database directory permissions
+chmod 700 ./db/data/
+chmod 600 ./db/data/db.sqlite
+
+# Use encrypted storage if possible
+# Consider full disk encryption for production
+```
+
+### Monitoring and Alerting
+
+#### Health Checks
+
+The encryption system provides health check endpoints:
+
+```bash
+# Check encryption status
+GET /encryption/status
+
+# Response format:
+{
+  "encryption": {
+    "enabled": true,
+    "configValid": true,
+    "forceEncryption": false,
+    "migrateOnAccess": true
+  },
+  "migration": {
+    "isEncryptionEnabled": true,
+    "migrationCompleted": true,
+    "migrationDate": "2024-01-15T10:30:00Z"
+  }
+}
+```
+
+#### Log Monitoring
+
+Monitor logs for encryption-related events:
+
+```bash
+# Encryption initialization
+"Database encryption initialized successfully"
+
+# Migration events
+"Migration completed for table: users"
+
+# Security warnings
+"DB_ENCRYPTION_KEY not set, using default (INSECURE)"
+```
+
+### Troubleshooting
+
+#### Common Issues
+
+**1. "Decryption failed" errors**
+- Verify `DB_ENCRYPTION_KEY` is correct
+- Check if database was corrupted
+- Restore from backup if necessary
+
+**2. Performance issues**
+- Encryption adds ~1ms per operation
+- Consider disabling `MIGRATE_ON_ACCESS` after migration
+- Monitor CPU usage during large migrations
+
+**3. Key rotation**
+```bash
+# Generate new key
+NEW_KEY=$(openssl rand -hex 32)
+
+# Update configuration
+# Note: Requires re-encryption of all data
+```
+
+### Compliance Notes
+
+This encryption implementation helps meet requirements for:
+
+- **GDPR** - Personal data protection
+- **SOC 2** - Data security controls
+- **PCI DSS** - Sensitive data protection
+- **HIPAA** - Healthcare data encryption (if applicable)
+
+### Security Limitations
+
+**What this protects against:**
+- Database file theft
+- Disk access by unauthorized users
+- Data breaches from file system access
+
+**What this does NOT protect against:**
+- Application-level vulnerabilities
+- Memory dumps while application is running
+- Attacks against the running application
+- Social engineering attacks
+
+### Emergency Procedures
+
+#### Lost Encryption Key
+
+⚠️ **Data is unrecoverable without the encryption key**
+
+1. Check all backup locations
+2. Restore from unencrypted backup if available
+3. Contact system administrators
+
+#### Suspected Key Compromise
+
+1. **Immediately** generate new encryption key
+2. Take application offline
+3. Re-encrypt all sensitive data with new key
+4. Investigate compromise source
+5. Update security procedures
+
+### Support
+
+For security-related questions:
+- Open issue: [GitHub Issues](https://github.com/LukeGus/Termix/issues)
+- Discord: [Termix Community](https://discord.gg/jVQGdvHDrf)
+
+**Do not share encryption keys or sensitive debugging information in public channels.**
\ No newline at end of file
diff --git a/package.json b/package.json
index 78bd621d..a7adac32 100644
--- a/package.json
+++ b/package.json
@@ -18,7 +18,9 @@
     "electron:dev": "concurrently \"npm run dev\" \"wait-on http://localhost:5173 && electron .\"",
     "build:win-portable": "npm run build && electron-builder --win --dir",
     "build:win-installer": "npm run build && electron-builder --win --publish=never",
-    "build:linux-portable": "npm run build && electron-builder --linux --dir"
+    "build:linux-portable": "npm run build && electron-builder --linux --dir",
+    "test:encryption": "tsc -p tsconfig.node.json && node ./dist/backend/backend/utils/encryption-test.js",
+    "migrate:encryption": "tsc -p tsconfig.node.json && node ./dist/backend/backend/utils/encryption-migration.js"
   },
   "dependencies": {
     "@hookform/resolvers": "^5.1.1",
diff --git a/src/backend/database/database.ts b/src/backend/database/database.ts
index 50f169db..f9ab6f86 100644
--- a/src/backend/database/database.ts
+++ b/src/backend/database/database.ts
@@ -10,6 +10,8 @@ import fs from "fs";
 import path from "path";
 import "dotenv/config";
 import { databaseLogger, apiLogger } from "../utils/logger.js";
+import { DatabaseEncryption } from "../utils/database-encryption.js";
+import { EncryptionMigration } from "../utils/encryption-migration.js";
 
 const app = express();
 app.use(
@@ -255,6 +257,111 @@ app.get("/releases/rss", async (req, res) => {
   }
 });
 
+app.get("/encryption/status", async (req, res) => {
+  try {
+    const detailedStatus = await DatabaseEncryption.getDetailedStatus();
+    const migrationStatus = await EncryptionMigration.checkMigrationStatus();
+
+    res.json({
+      encryption: detailedStatus,
+      migration: migrationStatus
+    });
+  } catch (error) {
+    apiLogger.error("Failed to get encryption status", error, {
+      operation: "encryption_status"
+    });
+    res.status(500).json({ error: "Failed to get encryption status" });
+  }
+});
+
+app.post("/encryption/initialize", async (req, res) => {
+  try {
+    const { EncryptionKeyManager } = await import("../utils/encryption-key-manager.js");
+    const keyManager = EncryptionKeyManager.getInstance();
+
+    const newKey = await keyManager.generateNewKey();
+    await DatabaseEncryption.initialize({ masterPassword: newKey });
+
+    apiLogger.info("Encryption initialized via API", {
+      operation: "encryption_init_api"
+    });
+
+    res.json({
+      success: true,
+      message: "Encryption initialized successfully",
+      keyPreview: newKey.substring(0, 8) + "..."
+    });
+  } catch (error) {
+    apiLogger.error("Failed to initialize encryption", error, {
+      operation: "encryption_init_api_failed"
+    });
+    res.status(500).json({ error: "Failed to initialize encryption" });
+  }
+});
+
+app.post("/encryption/migrate", async (req, res) => {
+  try {
+    const { dryRun = false } = req.body;
+
+    const migration = new EncryptionMigration({
+      dryRun,
+      backupEnabled: true
+    });
+
+    if (dryRun) {
+      apiLogger.info("Starting encryption migration (dry run)", {
+        operation: "encryption_migrate_dry_run"
+      });
+
+      res.json({
+        success: true,
+        message: "Dry run mode - no changes made",
+        dryRun: true
+      });
+    } else {
+      apiLogger.info("Starting encryption migration", {
+        operation: "encryption_migrate"
+      });
+
+      await migration.runMigration();
+
+      res.json({
+        success: true,
+        message: "Migration completed successfully"
+      });
+    }
+  } catch (error) {
+    apiLogger.error("Migration failed", error, {
+      operation: "encryption_migrate_failed"
+    });
+    res.status(500).json({
+      error: "Migration failed",
+      details: error instanceof Error ? error.message : "Unknown error"
+    });
+  }
+});
+
+app.post("/encryption/regenerate", async (req, res) => {
+  try {
+    await DatabaseEncryption.reinitializeWithNewKey();
+
+    apiLogger.warn("Encryption key regenerated via API", {
+      operation: "encryption_regenerate_api"
+    });
+
+    res.json({
+      success: true,
+      message: "New encryption key generated",
+      warning: "All encrypted data must be re-encrypted"
+    });
+  } catch (error) {
+    apiLogger.error("Failed to regenerate encryption key", error, {
+      operation: "encryption_regenerate_failed"
+    });
+    res.status(500).json({ error: "Failed to regenerate encryption key" });
+  }
+});
+
 app.use("/users", userRoutes);
 app.use("/ssh", sshRoutes);
 app.use("/alerts", alertRoutes);
@@ -278,7 +385,43 @@ app.use(
 );
 
 const PORT = 8081;
-app.listen(PORT, () => {
+
+async function initializeEncryption() {
+  try {
+    databaseLogger.info("Initializing database encryption...", {
+      operation: "encryption_init"
+    });
+
+    await DatabaseEncryption.initialize({
+      encryptionEnabled: process.env.ENCRYPTION_ENABLED !== 'false',
+      forceEncryption: process.env.FORCE_ENCRYPTION === 'true',
+      migrateOnAccess: process.env.MIGRATE_ON_ACCESS !== 'false'
+    });
+
+    const status = await DatabaseEncryption.getDetailedStatus();
+    if (status.configValid && status.key.keyValid) {
+      databaseLogger.success("Database encryption initialized successfully", {
+        operation: "encryption_init_complete",
+        enabled: status.enabled,
+        keyId: status.key.keyId,
+        hasStoredKey: status.key.hasKey
+      });
+    } else {
+      databaseLogger.error("Database encryption configuration invalid", undefined, {
+        operation: "encryption_init_failed",
+        status
+      });
+    }
+  } catch (error) {
+    databaseLogger.error("Failed to initialize database encryption", error, {
+      operation: "encryption_init_error"
+    });
+  }
+}
+
+app.listen(PORT, async () => {
+  await initializeEncryption();
+
   databaseLogger.success(`Database API server started on port ${PORT}`, {
     operation: "server_start",
     port: PORT,
@@ -290,6 +433,10 @@ app.listen(PORT, () => {
       "/health",
       "/version",
       "/releases/rss",
+      "/encryption/status",
+      "/encryption/initialize",
+      "/encryption/migrate",
+      "/encryption/regenerate",
     ],
   });
 });
diff --git a/src/backend/database/db/index.ts b/src/backend/database/db/index.ts
index 1dd17218..369541e5 100644
--- a/src/backend/database/db/index.ts
+++ b/src/backend/database/db/index.ts
@@ -250,6 +250,11 @@ const migrateSchema = () => {
     "INTEGER REFERENCES ssh_credentials(id)",
   );
 
+  // SSH credentials table migrations for encryption support
+  addColumnIfNotExists("ssh_credentials", "private_key", "TEXT");
+  addColumnIfNotExists("ssh_credentials", "public_key", "TEXT");
+  addColumnIfNotExists("ssh_credentials", "detected_key_type", "TEXT");
+
   addColumnIfNotExists("file_manager_recent", "host_id", "INTEGER NOT NULL");
   addColumnIfNotExists("file_manager_pinned", "host_id", "INTEGER NOT NULL");
   addColumnIfNotExists("file_manager_shortcuts", "host_id", "INTEGER NOT NULL");
diff --git a/src/backend/database/routes/credentials.ts b/src/backend/database/routes/credentials.ts
index 51e0bef4..8b5f2092 100644
--- a/src/backend/database/routes/credentials.ts
+++ b/src/backend/database/routes/credentials.ts
@@ -5,6 +5,7 @@ import { eq, and, desc, sql } from "drizzle-orm";
 import type { Request, Response, NextFunction } from "express";
 import jwt from "jsonwebtoken";
 import { authLogger } from "../../utils/logger.js";
+import { EncryptedDBOperations } from "../../utils/encrypted-db-operations.js";
 import { parseSSHKey, parsePublicKey, detectKeyType, validateKeyPair } from "../../utils/ssh-key-utils.js";
 import crypto from "crypto";
 import ssh2Pkg from "ssh2";
@@ -194,11 +195,11 @@ router.post("/", authenticateJWT, async (req: Request, res: Response) => {
       lastUsed: null,
     };
 
-    const result = await db
-      .insert(sshCredentials)
-      .values(credentialData)
-      .returning();
-    const created = result[0];
+    const created = await EncryptedDBOperations.insert(
+      sshCredentials,
+      'ssh_credentials',
+      credentialData
+    ) as typeof credentialData & { id: number };
 
     authLogger.success(
       `SSH credential created: ${name} (${authType}) by user ${userId}`,
@@ -238,11 +239,10 @@ router.get("/", authenticateJWT, async (req: Request, res: Response) => {
   }
 
   try {
-    const credentials = await db
-      .select()
-      .from(sshCredentials)
-      .where(eq(sshCredentials.userId, userId))
-      .orderBy(desc(sshCredentials.updatedAt));
+    const credentials = await EncryptedDBOperations.select(
+      db.select().from(sshCredentials).where(eq(sshCredentials.userId, userId)).orderBy(desc(sshCredentials.updatedAt)),
+      'ssh_credentials'
+    );
 
     res.json(credentials.map((cred) => formatCredentialOutput(cred)));
   } catch (err) {
@@ -296,15 +296,13 @@ router.get("/:id", authenticateJWT, async (req: Request, res: Response) => {
   }
 
   try {
-    const credentials = await db
-      .select()
-      .from(sshCredentials)
-      .where(
-        and(
-          eq(sshCredentials.id, parseInt(id)),
-          eq(sshCredentials.userId, userId),
-        ),
-      );
+    const credentials = await EncryptedDBOperations.select(
+      db.select().from(sshCredentials).where(and(
+        eq(sshCredentials.id, parseInt(id)),
+        eq(sshCredentials.userId, userId),
+      )),
+      'ssh_credentials'
+    );
 
     if (credentials.length === 0) {
       return res.status(404).json({ error: "Credential not found" });
@@ -415,28 +413,28 @@ router.put("/:id", authenticateJWT, async (req: Request, res: Response) => {
     }
 
     if (Object.keys(updateFields).length === 0) {
-      const existing = await db
-        .select()
-        .from(sshCredentials)
-        .where(eq(sshCredentials.id, parseInt(id)));
+      const existing = await EncryptedDBOperations.select(
+        db.select().from(sshCredentials).where(eq(sshCredentials.id, parseInt(id))),
+        'ssh_credentials'
+      );
 
       return res.json(formatCredentialOutput(existing[0]));
     }
 
-    await db
-      .update(sshCredentials)
-      .set(updateFields)
-      .where(
-        and(
-          eq(sshCredentials.id, parseInt(id)),
-          eq(sshCredentials.userId, userId),
-        ),
-      );
+    await EncryptedDBOperations.update(
+      sshCredentials,
+      'ssh_credentials',
+      and(
+        eq(sshCredentials.id, parseInt(id)),
+        eq(sshCredentials.userId, userId),
+      ),
+      updateFields
+    );
 
-    const updated = await db
-      .select()
-      .from(sshCredentials)
-      .where(eq(sshCredentials.id, parseInt(id)));
+    const updated = await EncryptedDBOperations.select(
+      db.select().from(sshCredentials).where(eq(sshCredentials.id, parseInt(id))),
+      'ssh_credentials'
+    );
 
     const credential = updated[0];
     authLogger.success(
diff --git a/src/backend/database/routes/ssh.ts b/src/backend/database/routes/ssh.ts
index b08d39dd..f070cfaf 100644
--- a/src/backend/database/routes/ssh.ts
+++ b/src/backend/database/routes/ssh.ts
@@ -13,6 +13,7 @@ import type { Request, Response, NextFunction } from "express";
 import jwt from "jsonwebtoken";
 import multer from "multer";
 import { sshLogger } from "../../utils/logger.js";
+import { EncryptedDBOperations } from "../../utils/encrypted-db-operations.js";
 
 const router = express.Router();
 
@@ -62,7 +63,10 @@ router.get("/db/host/internal", async (req: Request, res: Response) => {
     return res.status(403).json({ error: "Forbidden" });
   }
   try {
-    const data = await db.select().from(sshData);
+    const data = await EncryptedDBOperations.select(
+      db.select().from(sshData),
+      'ssh_data'
+    );
     const result = data.map((row: any) => {
       return {
         ...row,
diff --git a/src/backend/ssh/server-stats.ts b/src/backend/ssh/server-stats.ts
index bdc8ec50..7f9150b4 100644
--- a/src/backend/ssh/server-stats.ts
+++ b/src/backend/ssh/server-stats.ts
@@ -6,6 +6,7 @@ import { db } from "../database/db/index.js";
 import { sshData, sshCredentials } from "../database/db/schema.js";
 import { eq, and } from "drizzle-orm";
 import { statsLogger } from "../utils/logger.js";
+import { EncryptedDBOperations } from "../utils/encrypted-db-operations.js";
 
 interface PooledConnection {
   client: Client;
@@ -306,7 +307,10 @@ const hostStatuses: Map<number, StatusEntry> = new Map();
 
 async function fetchAllHosts(): Promise<SSHHostWithCredentials[]> {
   try {
-    const hosts = await db.select().from(sshData);
+    const hosts = await EncryptedDBOperations.select(
+      db.select().from(sshData),
+      'ssh_data'
+    );
 
     const hostsWithCredentials: SSHHostWithCredentials[] = [];
     for (const host of hosts) {
@@ -333,7 +337,10 @@ async function fetchHostById(
   id: number,
 ): Promise<SSHHostWithCredentials | undefined> {
   try {
-    const hosts = await db.select().from(sshData).where(eq(sshData.id, id));
+    const hosts = await EncryptedDBOperations.select(
+      db.select().from(sshData).where(eq(sshData.id, id)),
+      'ssh_data'
+    );
 
     if (hosts.length === 0) {
       return undefined;
@@ -380,15 +387,13 @@ async function resolveHostCredentials(
 
     if (host.credentialId) {
       try {
-        const credentials = await db
-          .select()
-          .from(sshCredentials)
-          .where(
-            and(
-              eq(sshCredentials.id, host.credentialId),
-              eq(sshCredentials.userId, host.userId),
-            ),
-          );
+        const credentials = await EncryptedDBOperations.select(
+          db.select().from(sshCredentials).where(and(
+            eq(sshCredentials.id, host.credentialId),
+            eq(sshCredentials.userId, host.userId),
+          )),
+          'ssh_credentials'
+        );
 
         if (credentials.length > 0) {
           const credential = credentials[0];
diff --git a/src/backend/starter.ts b/src/backend/starter.ts
index 83caf7ed..80fdc5de 100644
--- a/src/backend/starter.ts
+++ b/src/backend/starter.ts
@@ -2,10 +2,7 @@
 //  node ./dist/backend/starter.js
 
 import "./database/database.js";
-import "./ssh/terminal.js";
-import "./ssh/tunnel.js";
-import "./ssh/file-manager.js";
-import "./ssh/server-stats.js";
+import { DatabaseEncryption } from "./utils/database-encryption.js";
 import { systemLogger, versionLogger } from "./utils/logger.js";
 import "dotenv/config";
 
@@ -21,9 +18,21 @@ import "dotenv/config";
       operation: "startup",
     });
 
+    // Initialize database encryption before other services
+    await DatabaseEncryption.initialize();
+    systemLogger.info("Database encryption initialized", {
+      operation: "encryption_init",
+    });
+
+    // Load modules that depend on encryption after initialization
+    await import("./ssh/terminal.js");
+    await import("./ssh/tunnel.js");
+    await import("./ssh/file-manager.js");
+    await import("./ssh/server-stats.js");
+
     systemLogger.success("All backend services initialized successfully", {
       operation: "startup_complete",
-      services: ["database", "terminal", "tunnel", "file_manager", "stats"],
+      services: ["database", "encryption", "terminal", "tunnel", "file_manager", "stats"],
       version: version,
     });
 
diff --git a/src/backend/utils/database-encryption.ts b/src/backend/utils/database-encryption.ts
new file mode 100644
index 00000000..57e2d55f
--- /dev/null
+++ b/src/backend/utils/database-encryption.ts
@@ -0,0 +1,252 @@
+import { FieldEncryption } from './encryption.js';
+import { EncryptionKeyManager } from './encryption-key-manager.js';
+import { databaseLogger } from './logger.js';
+
+interface EncryptionContext {
+  masterPassword: string;
+  encryptionEnabled: boolean;
+  forceEncryption: boolean;
+  migrateOnAccess: boolean;
+}
+
+class DatabaseEncryption {
+  private static context: EncryptionContext | null = null;
+
+  static async initialize(config: Partial<EncryptionContext> = {}) {
+    const keyManager = EncryptionKeyManager.getInstance();
+    const masterPassword = config.masterPassword || await keyManager.initializeKey();
+
+    this.context = {
+      masterPassword,
+      encryptionEnabled: config.encryptionEnabled ?? true,
+      forceEncryption: config.forceEncryption ?? false,
+      migrateOnAccess: config.migrateOnAccess ?? true
+    };
+
+    databaseLogger.info('Database encryption initialized', {
+      operation: 'encryption_init',
+      enabled: this.context.encryptionEnabled,
+      forceEncryption: this.context.forceEncryption,
+      dynamicKey: !config.masterPassword
+    });
+  }
+
+  static getContext(): EncryptionContext {
+    if (!this.context) {
+      throw new Error('DatabaseEncryption not initialized. Call initialize() first.');
+    }
+    return this.context;
+  }
+
+  static encryptRecord(tableName: string, record: any): any {
+    const context = this.getContext();
+    if (!context.encryptionEnabled) return record;
+
+    const encryptedRecord = { ...record };
+    let hasEncryption = false;
+
+    for (const [fieldName, value] of Object.entries(record)) {
+      if (FieldEncryption.shouldEncryptField(tableName, fieldName) && value) {
+        try {
+          const fieldKey = FieldEncryption.getFieldKey(context.masterPassword, `${tableName}.${fieldName}`);
+          encryptedRecord[fieldName] = FieldEncryption.encryptField(value as string, fieldKey);
+          hasEncryption = true;
+        } catch (error) {
+          databaseLogger.error(`Failed to encrypt field ${tableName}.${fieldName}`, error, {
+            operation: 'field_encryption',
+            table: tableName,
+            field: fieldName
+          });
+          throw error;
+        }
+      }
+    }
+
+    if (hasEncryption) {
+      databaseLogger.debug(`Encrypted sensitive fields for ${tableName}`, {
+        operation: 'record_encryption',
+        table: tableName
+      });
+    }
+
+    return encryptedRecord;
+  }
+
+  static decryptRecord(tableName: string, record: any): any {
+    const context = this.getContext();
+    if (!record) return record;
+
+    const decryptedRecord = { ...record };
+    let hasDecryption = false;
+    let needsMigration = false;
+
+    for (const [fieldName, value] of Object.entries(record)) {
+      if (FieldEncryption.shouldEncryptField(tableName, fieldName) && value) {
+        try {
+          const fieldKey = FieldEncryption.getFieldKey(context.masterPassword, `${tableName}.${fieldName}`);
+
+          if (FieldEncryption.isEncrypted(value as string)) {
+            decryptedRecord[fieldName] = FieldEncryption.decryptField(value as string, fieldKey);
+            hasDecryption = true;
+          } else if (context.encryptionEnabled && !context.forceEncryption) {
+            decryptedRecord[fieldName] = value;
+            needsMigration = context.migrateOnAccess;
+          } else if (context.forceEncryption) {
+            databaseLogger.warn(`Unencrypted field detected in force encryption mode`, {
+              operation: 'decryption_warning',
+              table: tableName,
+              field: fieldName
+            });
+            decryptedRecord[fieldName] = value;
+          }
+        } catch (error) {
+          databaseLogger.error(`Failed to decrypt field ${tableName}.${fieldName}`, error, {
+            operation: 'field_decryption',
+            table: tableName,
+            field: fieldName
+          });
+
+          if (context.forceEncryption) {
+            throw error;
+          } else {
+            decryptedRecord[fieldName] = value;
+          }
+        }
+      }
+    }
+
+    if (hasDecryption) {
+      databaseLogger.debug(`Decrypted sensitive fields for ${tableName}`, {
+        operation: 'record_decryption',
+        table: tableName
+      });
+    }
+
+    if (needsMigration) {
+      this.scheduleFieldMigration(tableName, record);
+    }
+
+    return decryptedRecord;
+  }
+
+  static decryptRecords(tableName: string, records: any[]): any[] {
+    if (!Array.isArray(records)) return records;
+    return records.map(record => this.decryptRecord(tableName, record));
+  }
+
+  private static scheduleFieldMigration(tableName: string, record: any) {
+    setTimeout(async () => {
+      try {
+        await this.migrateRecord(tableName, record);
+      } catch (error) {
+        databaseLogger.error(`Failed to migrate record ${tableName}:${record.id}`, error, {
+          operation: 'migration_failed',
+          table: tableName,
+          recordId: record.id
+        });
+      }
+    }, 1000);
+  }
+
+  static async migrateRecord(tableName: string, record: any): Promise<any> {
+    const context = this.getContext();
+    if (!context.encryptionEnabled || !context.migrateOnAccess) return record;
+
+    let needsUpdate = false;
+    const updatedRecord = { ...record };
+
+    for (const [fieldName, value] of Object.entries(record)) {
+      if (FieldEncryption.shouldEncryptField(tableName, fieldName) &&
+          value && !FieldEncryption.isEncrypted(value as string)) {
+        try {
+          const fieldKey = FieldEncryption.getFieldKey(context.masterPassword, `${tableName}.${fieldName}`);
+          updatedRecord[fieldName] = FieldEncryption.encryptField(value as string, fieldKey);
+          needsUpdate = true;
+        } catch (error) {
+          databaseLogger.error(`Failed to migrate field ${tableName}.${fieldName}`, error, {
+            operation: 'field_migration',
+            table: tableName,
+            field: fieldName,
+            recordId: record.id
+          });
+          throw error;
+        }
+      }
+    }
+
+    if (needsUpdate) {
+      databaseLogger.info(`Migrated record to encrypted format`, {
+        operation: 'record_migration',
+        table: tableName,
+        recordId: record.id
+      });
+    }
+
+    return updatedRecord;
+  }
+
+  static validateConfiguration(): boolean {
+    try {
+      const context = this.getContext();
+      const testData = 'test-encryption-data';
+      const testKey = FieldEncryption.getFieldKey(context.masterPassword, 'test');
+
+      const encrypted = FieldEncryption.encryptField(testData, testKey);
+      const decrypted = FieldEncryption.decryptField(encrypted, testKey);
+
+      return decrypted === testData;
+    } catch (error) {
+      databaseLogger.error('Encryption configuration validation failed', error, {
+        operation: 'config_validation'
+      });
+      return false;
+    }
+  }
+
+  static getEncryptionStatus() {
+    try {
+      const context = this.getContext();
+      return {
+        enabled: context.encryptionEnabled,
+        forceEncryption: context.forceEncryption,
+        migrateOnAccess: context.migrateOnAccess,
+        configValid: this.validateConfiguration()
+      };
+    } catch {
+      return {
+        enabled: false,
+        forceEncryption: false,
+        migrateOnAccess: false,
+        configValid: false
+      };
+    }
+  }
+
+  static async getDetailedStatus() {
+    const keyManager = EncryptionKeyManager.getInstance();
+    const keyStatus = await keyManager.getEncryptionStatus();
+    const encryptionStatus = this.getEncryptionStatus();
+
+    return {
+      ...encryptionStatus,
+      key: keyStatus,
+      initialized: this.context !== null
+    };
+  }
+
+  static async reinitializeWithNewKey(): Promise<void> {
+    const keyManager = EncryptionKeyManager.getInstance();
+    const newKey = await keyManager.regenerateKey();
+
+    this.context = null;
+    await this.initialize({ masterPassword: newKey });
+
+    databaseLogger.warn('Database encryption reinitialized with new key', {
+      operation: 'encryption_reinit',
+      requiresMigration: true
+    });
+  }
+}
+
+export { DatabaseEncryption };
+export type { EncryptionContext };
\ No newline at end of file
diff --git a/src/backend/utils/encrypted-db-operations.ts b/src/backend/utils/encrypted-db-operations.ts
new file mode 100644
index 00000000..3c866c53
--- /dev/null
+++ b/src/backend/utils/encrypted-db-operations.ts
@@ -0,0 +1,214 @@
+import { db } from '../database/db/index.js';
+import { DatabaseEncryption } from './database-encryption.js';
+import { databaseLogger } from './logger.js';
+import type { SQLiteTable } from 'drizzle-orm/sqlite-core';
+
+type TableName = 'users' | 'ssh_data' | 'ssh_credentials';
+
+class EncryptedDBOperations {
+  static async insert<T extends Record<string, any>>(
+    table: SQLiteTable<any>,
+    tableName: TableName,
+    data: T
+  ): Promise<T> {
+    try {
+      const encryptedData = DatabaseEncryption.encryptRecord(tableName, data);
+      const result = await db.insert(table).values(encryptedData).returning();
+
+      // Decrypt the returned data to ensure consistency
+      const decryptedResult = DatabaseEncryption.decryptRecord(tableName, result[0]);
+
+      databaseLogger.debug(`Inserted encrypted record into ${tableName}`, {
+        operation: 'encrypted_insert',
+        table: tableName
+      });
+
+      return decryptedResult as T;
+    } catch (error) {
+      databaseLogger.error(`Failed to insert encrypted record into ${tableName}`, error, {
+        operation: 'encrypted_insert_failed',
+        table: tableName
+      });
+      throw error;
+    }
+  }
+
+  static async select<T extends Record<string, any>>(
+    query: any,
+    tableName: TableName
+  ): Promise<T[]> {
+    try {
+      const results = await query;
+      const decryptedResults = DatabaseEncryption.decryptRecords(tableName, results);
+
+      databaseLogger.debug(`Selected and decrypted ${decryptedResults.length} records from ${tableName}`, {
+        operation: 'encrypted_select',
+        table: tableName,
+        count: decryptedResults.length
+      });
+
+      return decryptedResults;
+    } catch (error) {
+      databaseLogger.error(`Failed to select/decrypt records from ${tableName}`, error, {
+        operation: 'encrypted_select_failed',
+        table: tableName
+      });
+      throw error;
+    }
+  }
+
+  static async selectOne<T extends Record<string, any>>(
+    query: any,
+    tableName: TableName
+  ): Promise<T | undefined> {
+    try {
+      const result = await query;
+      if (!result) return undefined;
+
+      const decryptedResult = DatabaseEncryption.decryptRecord(tableName, result);
+
+      databaseLogger.debug(`Selected and decrypted single record from ${tableName}`, {
+        operation: 'encrypted_select_one',
+        table: tableName
+      });
+
+      return decryptedResult;
+    } catch (error) {
+      databaseLogger.error(`Failed to select/decrypt single record from ${tableName}`, error, {
+        operation: 'encrypted_select_one_failed',
+        table: tableName
+      });
+      throw error;
+    }
+  }
+
+  static async update<T extends Record<string, any>>(
+    table: SQLiteTable<any>,
+    tableName: TableName,
+    where: any,
+    data: Partial<T>
+  ): Promise<T[]> {
+    try {
+      const encryptedData = DatabaseEncryption.encryptRecord(tableName, data);
+      const result = await db.update(table).set(encryptedData).where(where).returning();
+
+      databaseLogger.debug(`Updated encrypted record in ${tableName}`, {
+        operation: 'encrypted_update',
+        table: tableName
+      });
+
+      return result as T[];
+    } catch (error) {
+      databaseLogger.error(`Failed to update encrypted record in ${tableName}`, error, {
+        operation: 'encrypted_update_failed',
+        table: tableName
+      });
+      throw error;
+    }
+  }
+
+  static async delete(
+    table: SQLiteTable<any>,
+    tableName: TableName,
+    where: any
+  ): Promise<any[]> {
+    try {
+      const result = await db.delete(table).where(where).returning();
+
+      databaseLogger.debug(`Deleted record from ${tableName}`, {
+        operation: 'encrypted_delete',
+        table: tableName
+      });
+
+      return result;
+    } catch (error) {
+      databaseLogger.error(`Failed to delete record from ${tableName}`, error, {
+        operation: 'encrypted_delete_failed',
+        table: tableName
+      });
+      throw error;
+    }
+  }
+
+  static async migrateExistingRecords(tableName: TableName): Promise<number> {
+    let migratedCount = 0;
+
+    try {
+      databaseLogger.info(`Starting encryption migration for ${tableName}`, {
+        operation: 'migration_start',
+        table: tableName
+      });
+
+      let table: SQLiteTable<any>;
+      let records: any[];
+
+      switch (tableName) {
+        case 'users':
+          const { users } = await import('../database/db/schema.js');
+          table = users;
+          records = await db.select().from(users);
+          break;
+        case 'ssh_data':
+          const { sshData } = await import('../database/db/schema.js');
+          table = sshData;
+          records = await db.select().from(sshData);
+          break;
+        case 'ssh_credentials':
+          const { sshCredentials } = await import('../database/db/schema.js');
+          table = sshCredentials;
+          records = await db.select().from(sshCredentials);
+          break;
+        default:
+          throw new Error(`Unknown table: ${tableName}`);
+      }
+
+      for (const record of records) {
+        try {
+          const migratedRecord = await DatabaseEncryption.migrateRecord(tableName, record);
+
+          if (JSON.stringify(migratedRecord) !== JSON.stringify(record)) {
+            const { eq } = await import('drizzle-orm');
+            await db.update(table).set(migratedRecord).where(eq((table as any).id, record.id));
+            migratedCount++;
+          }
+        } catch (error) {
+          databaseLogger.error(`Failed to migrate record ${record.id} in ${tableName}`, error, {
+            operation: 'migration_record_failed',
+            table: tableName,
+            recordId: record.id
+          });
+        }
+      }
+
+      databaseLogger.success(`Migration completed for ${tableName}`, {
+        operation: 'migration_complete',
+        table: tableName,
+        migratedCount,
+        totalRecords: records.length
+      });
+
+      return migratedCount;
+    } catch (error) {
+      databaseLogger.error(`Migration failed for ${tableName}`, error, {
+        operation: 'migration_failed',
+        table: tableName
+      });
+      throw error;
+    }
+  }
+
+  static async healthCheck(): Promise<boolean> {
+    try {
+      const status = DatabaseEncryption.getEncryptionStatus();
+      return status.configValid && status.enabled;
+    } catch (error) {
+      databaseLogger.error('Encryption health check failed', error, {
+        operation: 'health_check_failed'
+      });
+      return false;
+    }
+  }
+}
+
+export { EncryptedDBOperations };
+export type { TableName };
\ No newline at end of file
diff --git a/src/backend/utils/encryption-key-manager.ts b/src/backend/utils/encryption-key-manager.ts
index 6ffda967..0d65e41c 100644
--- a/src/backend/utils/encryption-key-manager.ts
+++ b/src/backend/utils/encryption-key-manager.ts
@@ -3,6 +3,7 @@ import { db } from '../database/db/index.js';
 import { settings } from '../database/db/schema.js';
 import { eq } from 'drizzle-orm';
 import { databaseLogger } from './logger.js';
+import { MasterKeyProtection } from './master-key-protection.js';
 
 interface EncryptionKeyInfo {
   hasKey: boolean;
@@ -26,11 +27,17 @@ class EncryptionKeyManager {
   }
 
   private encodeKey(key: string): string {
-    const buffer = Buffer.from(key, 'hex');
-    return Buffer.from(buffer).toString('base64');
+    return MasterKeyProtection.encryptMasterKey(key);
   }
 
   private decodeKey(encodedKey: string): string {
+    if (MasterKeyProtection.isProtectedKey(encodedKey)) {
+      return MasterKeyProtection.decryptMasterKey(encodedKey);
+    }
+
+    databaseLogger.warn('Found legacy base64-encoded key, migrating to KEK protection', {
+      operation: 'key_migration_legacy'
+    });
     const buffer = Buffer.from(encodedKey, 'base64');
     return buffer.toString('hex');
   }
@@ -117,7 +124,7 @@ class EncryptionKeyManager {
       algorithm: 'aes-256-gcm'
     };
 
-    const encodedData = Buffer.from(JSON.stringify(keyData)).toString('base64');
+    const encodedData = JSON.stringify(keyData);
 
     try {
       const existing = await db.select().from(settings).where(eq(settings.key, 'db_encryption_key'));
@@ -170,7 +177,16 @@ class EncryptionKeyManager {
       }
 
       const encodedData = result[0].value;
-      const keyData = JSON.parse(Buffer.from(encodedData, 'base64').toString());
+      let keyData;
+
+      try {
+        keyData = JSON.parse(encodedData);
+      } catch {
+        databaseLogger.warn('Found legacy base64-encoded key data, migrating', {
+          operation: 'key_data_migration_legacy'
+        });
+        keyData = JSON.parse(Buffer.from(encodedData, 'base64').toString());
+      }
 
       this.keyInfo = {
         hasKey: true,
@@ -179,7 +195,17 @@ class EncryptionKeyManager {
         algorithm: keyData.algorithm
       };
 
-      return this.decodeKey(keyData.key);
+      const decodedKey = this.decodeKey(keyData.key);
+
+      if (!MasterKeyProtection.isProtectedKey(keyData.key)) {
+        databaseLogger.info('Auto-migrating legacy key to KEK protection', {
+          operation: 'key_auto_migration',
+          keyId: keyData.keyId
+        });
+        await this.storeKey(decodedKey, keyData.keyId);
+      }
+
+      return decodedKey;
 
     } catch (error) {
       databaseLogger.error('Failed to retrieve stored encryption key', error, {
@@ -231,7 +257,8 @@ class EncryptionKeyManager {
 
     const entropyTest = new Set(key).size / key.length;
 
-    return (hasLower + hasUpper + hasDigit + hasSpecial) >= 3 && entropyTest > 0.4;
+    const complexity = Number(hasLower) + Number(hasUpper) + Number(hasDigit) + Number(hasSpecial);
+    return complexity >= 3 && entropyTest > 0.4;
   }
 
   async validateKey(key?: string): Promise<boolean> {
@@ -265,6 +292,7 @@ class EncryptionKeyManager {
   async getEncryptionStatus() {
     const keyInfo = await this.getKeyInfo();
     const isValid = await this.validateKey();
+    const kekProtected = await this.isKEKProtected();
 
     return {
       hasKey: keyInfo.hasKey,
@@ -272,9 +300,23 @@ class EncryptionKeyManager {
       keyId: keyInfo.keyId,
       createdAt: keyInfo.createdAt,
       algorithm: keyInfo.algorithm,
-      initialized: this.isInitialized()
+      initialized: this.isInitialized(),
+      kekProtected,
+      kekValid: kekProtected ? MasterKeyProtection.validateProtection() : false
     };
   }
+
+  private async isKEKProtected(): Promise<boolean> {
+    try {
+      const result = await db.select().from(settings).where(eq(settings.key, 'db_encryption_key'));
+      if (result.length === 0) return false;
+
+      const keyData = JSON.parse(result[0].value);
+      return MasterKeyProtection.isProtectedKey(keyData.key);
+    } catch {
+      return false;
+    }
+  }
 }
 
 export { EncryptionKeyManager };
diff --git a/src/backend/utils/encryption-migration.ts b/src/backend/utils/encryption-migration.ts
new file mode 100644
index 00000000..6ec3a62f
--- /dev/null
+++ b/src/backend/utils/encryption-migration.ts
@@ -0,0 +1,326 @@
+#!/usr/bin/env node
+import { DatabaseEncryption } from './database-encryption.js';
+import { EncryptedDBOperations } from './encrypted-db-operations.js';
+import { EncryptionKeyManager } from './encryption-key-manager.js';
+import { databaseLogger } from './logger.js';
+import { db } from '../database/db/index.js';
+import { settings } from '../database/db/schema.js';
+import { eq } from 'drizzle-orm';
+
+interface MigrationConfig {
+  masterPassword?: string;
+  forceEncryption?: boolean;
+  backupEnabled?: boolean;
+  dryRun?: boolean;
+}
+
+class EncryptionMigration {
+  private config: MigrationConfig;
+
+  constructor(config: MigrationConfig = {}) {
+    this.config = {
+      masterPassword: config.masterPassword,
+      forceEncryption: config.forceEncryption ?? false,
+      backupEnabled: config.backupEnabled ?? true,
+      dryRun: config.dryRun ?? false
+    };
+  }
+
+  async runMigration(): Promise<void> {
+    databaseLogger.info('Starting database encryption migration', {
+      operation: 'migration_start',
+      dryRun: this.config.dryRun,
+      forceEncryption: this.config.forceEncryption
+    });
+
+    try {
+      await this.validatePrerequisites();
+
+      if (this.config.backupEnabled && !this.config.dryRun) {
+        await this.createBackup();
+      }
+
+      await this.initializeEncryption();
+      await this.migrateTables();
+      await this.updateSettings();
+      await this.verifyMigration();
+
+      databaseLogger.success('Database encryption migration completed successfully', {
+        operation: 'migration_complete'
+      });
+
+    } catch (error) {
+      databaseLogger.error('Migration failed', error, {
+        operation: 'migration_failed'
+      });
+      throw error;
+    }
+  }
+
+  private async validatePrerequisites(): Promise<void> {
+    databaseLogger.info('Validating migration prerequisites', {
+      operation: 'validation'
+    });
+
+    // Check if KEK-managed encryption key exists
+    const keyManager = EncryptionKeyManager.getInstance();
+
+    if (!this.config.masterPassword) {
+      // Try to get current key from KEK manager
+      try {
+        const currentKey = keyManager.getCurrentKey();
+        if (!currentKey) {
+          // Initialize key if not available
+          const initializedKey = await keyManager.initializeKey();
+          this.config.masterPassword = initializedKey;
+        } else {
+          this.config.masterPassword = currentKey;
+        }
+      } catch (error) {
+        throw new Error('Failed to retrieve encryption key from KEK manager. Please ensure encryption is properly initialized.');
+      }
+    }
+
+    // Validate key strength
+    if (this.config.masterPassword.length < 16) {
+      throw new Error('Master password must be at least 16 characters long');
+    }
+
+    // Test database connection
+    try {
+      await db.select().from(settings).limit(1);
+    } catch (error) {
+      throw new Error('Database connection failed');
+    }
+
+    databaseLogger.success('Prerequisites validation passed', {
+      operation: 'validation_complete',
+      keySource: 'kek_manager'
+    });
+  }
+
+  private async createBackup(): Promise<void> {
+    databaseLogger.info('Creating database backup before migration', {
+      operation: 'backup_start'
+    });
+
+    try {
+      const fs = await import('fs');
+      const path = await import('path');
+      const dataDir = process.env.DATA_DIR || './db/data';
+      const dbPath = path.join(dataDir, 'db.sqlite');
+      const backupPath = path.join(dataDir, `db-backup-${Date.now()}.sqlite`);
+
+      if (fs.existsSync(dbPath)) {
+        fs.copyFileSync(dbPath, backupPath);
+        databaseLogger.success(`Database backup created: ${backupPath}`, {
+          operation: 'backup_complete',
+          backupPath
+        });
+      }
+    } catch (error) {
+      databaseLogger.error('Failed to create backup', error, {
+        operation: 'backup_failed'
+      });
+      throw error;
+    }
+  }
+
+  private async initializeEncryption(): Promise<void> {
+    databaseLogger.info('Initializing encryption system', {
+      operation: 'encryption_init'
+    });
+
+    DatabaseEncryption.initialize({
+      masterPassword: this.config.masterPassword!,
+      encryptionEnabled: true,
+      forceEncryption: this.config.forceEncryption,
+      migrateOnAccess: true
+    });
+
+    const isHealthy = await EncryptedDBOperations.healthCheck();
+    if (!isHealthy) {
+      throw new Error('Encryption system health check failed');
+    }
+
+    databaseLogger.success('Encryption system initialized successfully', {
+      operation: 'encryption_init_complete'
+    });
+  }
+
+  private async migrateTables(): Promise<void> {
+    const tables: Array<'users' | 'ssh_data' | 'ssh_credentials'> = [
+      'users',
+      'ssh_data',
+      'ssh_credentials'
+    ];
+
+    let totalMigrated = 0;
+
+    for (const tableName of tables) {
+      databaseLogger.info(`Starting migration for table: ${tableName}`, {
+        operation: 'table_migration_start',
+        table: tableName
+      });
+
+      try {
+        if (this.config.dryRun) {
+          databaseLogger.info(`[DRY RUN] Would migrate table: ${tableName}`, {
+            operation: 'dry_run_table',
+            table: tableName
+          });
+          continue;
+        }
+
+        const migratedCount = await EncryptedDBOperations.migrateExistingRecords(tableName);
+        totalMigrated += migratedCount;
+
+        databaseLogger.success(`Migration completed for table: ${tableName}`, {
+          operation: 'table_migration_complete',
+          table: tableName,
+          migratedCount
+        });
+
+      } catch (error) {
+        databaseLogger.error(`Migration failed for table: ${tableName}`, error, {
+          operation: 'table_migration_failed',
+          table: tableName
+        });
+        throw error;
+      }
+    }
+
+    databaseLogger.success(`All tables migrated successfully`, {
+      operation: 'all_tables_migrated',
+      totalMigrated
+    });
+  }
+
+  private async updateSettings(): Promise<void> {
+    if (this.config.dryRun) {
+      databaseLogger.info('[DRY RUN] Would update encryption settings', {
+        operation: 'dry_run_settings'
+      });
+      return;
+    }
+
+    try {
+      const encryptionSettings = [
+        { key: 'encryption_enabled', value: 'true' },
+        { key: 'encryption_migration_completed', value: new Date().toISOString() },
+        { key: 'encryption_version', value: '1.0' }
+      ];
+
+      for (const setting of encryptionSettings) {
+        const existing = await db.select().from(settings).where(eq(settings.key, setting.key));
+
+        if (existing.length > 0) {
+          await db.update(settings).set({ value: setting.value }).where(eq(settings.key, setting.key));
+        } else {
+          await db.insert(settings).values(setting);
+        }
+      }
+
+      databaseLogger.success('Encryption settings updated', {
+        operation: 'settings_updated'
+      });
+
+    } catch (error) {
+      databaseLogger.error('Failed to update settings', error, {
+        operation: 'settings_update_failed'
+      });
+      throw error;
+    }
+  }
+
+  private async verifyMigration(): Promise<void> {
+    databaseLogger.info('Verifying migration integrity', {
+      operation: 'verification_start'
+    });
+
+    try {
+      const status = DatabaseEncryption.getEncryptionStatus();
+
+      if (!status.enabled || !status.configValid) {
+        throw new Error('Encryption system verification failed');
+      }
+
+      const testResult = await this.performTestEncryption();
+      if (!testResult) {
+        throw new Error('Test encryption/decryption failed');
+      }
+
+      databaseLogger.success('Migration verification completed successfully', {
+        operation: 'verification_complete',
+        status
+      });
+
+    } catch (error) {
+      databaseLogger.error('Migration verification failed', error, {
+        operation: 'verification_failed'
+      });
+      throw error;
+    }
+  }
+
+  private async performTestEncryption(): Promise<boolean> {
+    try {
+      const { FieldEncryption } = await import('./encryption.js');
+      const testData = `test-data-${Date.now()}`;
+      const testKey = FieldEncryption.getFieldKey(this.config.masterPassword!, 'test');
+
+      const encrypted = FieldEncryption.encryptField(testData, testKey);
+      const decrypted = FieldEncryption.decryptField(encrypted, testKey);
+
+      return decrypted === testData;
+    } catch {
+      return false;
+    }
+  }
+
+  static async checkMigrationStatus(): Promise<{
+    isEncryptionEnabled: boolean;
+    migrationCompleted: boolean;
+    migrationDate?: string;
+  }> {
+    try {
+      const encryptionEnabled = await db.select().from(settings).where(eq(settings.key, 'encryption_enabled'));
+      const migrationCompleted = await db.select().from(settings).where(eq(settings.key, 'encryption_migration_completed'));
+
+      return {
+        isEncryptionEnabled: encryptionEnabled.length > 0 && encryptionEnabled[0].value === 'true',
+        migrationCompleted: migrationCompleted.length > 0,
+        migrationDate: migrationCompleted.length > 0 ? migrationCompleted[0].value : undefined
+      };
+    } catch (error) {
+      databaseLogger.error('Failed to check migration status', error, {
+        operation: 'status_check_failed'
+      });
+      throw error;
+    }
+  }
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const config: MigrationConfig = {
+    masterPassword: process.env.DB_ENCRYPTION_KEY,
+    forceEncryption: process.env.FORCE_ENCRYPTION === 'true',
+    backupEnabled: process.env.BACKUP_ENABLED !== 'false',
+    dryRun: process.env.DRY_RUN === 'true'
+  };
+
+  const migration = new EncryptionMigration(config);
+
+  migration.runMigration()
+    .then(() => {
+      console.log('Migration completed successfully');
+      process.exit(0);
+    })
+    .catch((error) => {
+      console.error('Migration failed:', error.message);
+      process.exit(1);
+    });
+}
+
+export { EncryptionMigration };
+export type { MigrationConfig };
\ No newline at end of file
diff --git a/src/backend/utils/encryption-test.ts b/src/backend/utils/encryption-test.ts
new file mode 100644
index 00000000..d8f9e7e7
--- /dev/null
+++ b/src/backend/utils/encryption-test.ts
@@ -0,0 +1,293 @@
+#!/usr/bin/env node
+import { FieldEncryption } from './encryption.js';
+import { DatabaseEncryption } from './database-encryption.js';
+import { EncryptedDBOperations } from './encrypted-db-operations.js';
+import { databaseLogger } from './logger.js';
+
+class EncryptionTest {
+  private testPassword = 'test-master-password-for-validation';
+
+  async runAllTests(): Promise<boolean> {
+    console.log('🔐 Starting Termix Database Encryption Tests...\n');
+
+    const tests = [
+      { name: 'Basic Encryption/Decryption', test: () => this.testBasicEncryption() },
+      { name: 'Field Encryption Detection', test: () => this.testFieldDetection() },
+      { name: 'Key Derivation', test: () => this.testKeyDerivation() },
+      { name: 'Database Encryption Context', test: () => this.testDatabaseContext() },
+      { name: 'Record Encryption/Decryption', test: () => this.testRecordOperations() },
+      { name: 'Backward Compatibility', test: () => this.testBackwardCompatibility() },
+      { name: 'Error Handling', test: () => this.testErrorHandling() },
+      { name: 'Performance Test', test: () => this.testPerformance() }
+    ];
+
+    let passedTests = 0;
+    let totalTests = tests.length;
+
+    for (const test of tests) {
+      try {
+        console.log(`⏳ Running: ${test.name}...`);
+        await test.test();
+        console.log(`✅ PASSED: ${test.name}\n`);
+        passedTests++;
+      } catch (error) {
+        console.log(`❌ FAILED: ${test.name}`);
+        console.log(`   Error: ${error instanceof Error ? error.message : 'Unknown error'}\n`);
+      }
+    }
+
+    const success = passedTests === totalTests;
+    console.log(`\n🎯 Test Results: ${passedTests}/${totalTests} tests passed`);
+
+    if (success) {
+      console.log('🎉 All encryption tests PASSED! System is ready for production.');
+    } else {
+      console.log('⚠️  Some tests FAILED! Please review the implementation.');
+    }
+
+    return success;
+  }
+
+  private async testBasicEncryption(): Promise<void> {
+    const testData = 'Hello, World! This is sensitive data.';
+    const key = FieldEncryption.getFieldKey(this.testPassword, 'test-field');
+
+    const encrypted = FieldEncryption.encryptField(testData, key);
+    const decrypted = FieldEncryption.decryptField(encrypted, key);
+
+    if (decrypted !== testData) {
+      throw new Error(`Decryption mismatch: expected "${testData}", got "${decrypted}"`);
+    }
+
+    if (!FieldEncryption.isEncrypted(encrypted)) {
+      throw new Error('Encrypted data not detected as encrypted');
+    }
+
+    if (FieldEncryption.isEncrypted(testData)) {
+      throw new Error('Plain text incorrectly detected as encrypted');
+    }
+  }
+
+  private async testFieldDetection(): Promise<void> {
+    const testCases = [
+      { table: 'users', field: 'password_hash', shouldEncrypt: true },
+      { table: 'users', field: 'username', shouldEncrypt: false },
+      { table: 'ssh_data', field: 'password', shouldEncrypt: true },
+      { table: 'ssh_data', field: 'ip', shouldEncrypt: false },
+      { table: 'ssh_credentials', field: 'privateKey', shouldEncrypt: true },
+      { table: 'unknown_table', field: 'any_field', shouldEncrypt: false }
+    ];
+
+    for (const testCase of testCases) {
+      const result = FieldEncryption.shouldEncryptField(testCase.table, testCase.field);
+      if (result !== testCase.shouldEncrypt) {
+        throw new Error(
+          `Field detection failed for ${testCase.table}.${testCase.field}: ` +
+          `expected ${testCase.shouldEncrypt}, got ${result}`
+        );
+      }
+    }
+  }
+
+  private async testKeyDerivation(): Promise<void> {
+    const password = 'test-password';
+    const fieldType1 = 'users.password_hash';
+    const fieldType2 = 'ssh_data.password';
+
+    const key1a = FieldEncryption.getFieldKey(password, fieldType1);
+    const key1b = FieldEncryption.getFieldKey(password, fieldType1);
+    const key2 = FieldEncryption.getFieldKey(password, fieldType2);
+
+    if (!key1a.equals(key1b)) {
+      throw new Error('Same field type should produce identical keys');
+    }
+
+    if (key1a.equals(key2)) {
+      throw new Error('Different field types should produce different keys');
+    }
+
+    const differentPasswordKey = FieldEncryption.getFieldKey('different-password', fieldType1);
+    if (key1a.equals(differentPasswordKey)) {
+      throw new Error('Different passwords should produce different keys');
+    }
+  }
+
+  private async testDatabaseContext(): Promise<void> {
+    DatabaseEncryption.initialize({
+      masterPassword: this.testPassword,
+      encryptionEnabled: true,
+      forceEncryption: false,
+      migrateOnAccess: true
+    });
+
+    const status = DatabaseEncryption.getEncryptionStatus();
+    if (!status.enabled) {
+      throw new Error('Encryption should be enabled');
+    }
+
+    if (!status.configValid) {
+      throw new Error('Configuration should be valid');
+    }
+  }
+
+  private async testRecordOperations(): Promise<void> {
+    const testRecord = {
+      id: 'test-id-123',
+      username: 'testuser',
+      password_hash: 'sensitive-password-hash',
+      is_admin: false
+    };
+
+    const encrypted = DatabaseEncryption.encryptRecord('users', testRecord);
+    const decrypted = DatabaseEncryption.decryptRecord('users', encrypted);
+
+    if (decrypted.username !== testRecord.username) {
+      throw new Error('Non-sensitive field should remain unchanged');
+    }
+
+    if (decrypted.password_hash !== testRecord.password_hash) {
+      throw new Error('Sensitive field should be properly decrypted');
+    }
+
+    if (!FieldEncryption.isEncrypted(encrypted.password_hash)) {
+      throw new Error('Sensitive field should be encrypted in stored record');
+    }
+  }
+
+  private async testBackwardCompatibility(): Promise<void> {
+    const plaintextRecord = {
+      id: 'legacy-id-456',
+      username: 'legacyuser',
+      password_hash: 'plain-text-password-hash',
+      is_admin: false
+    };
+
+    const decrypted = DatabaseEncryption.decryptRecord('users', plaintextRecord);
+
+    if (decrypted.password_hash !== plaintextRecord.password_hash) {
+      throw new Error('Plain text fields should be returned as-is for backward compatibility');
+    }
+
+    if (decrypted.username !== plaintextRecord.username) {
+      throw new Error('Non-sensitive fields should be unchanged');
+    }
+  }
+
+  private async testErrorHandling(): Promise<void> {
+    const key = FieldEncryption.getFieldKey(this.testPassword, 'test');
+
+    try {
+      FieldEncryption.decryptField('invalid-json-data', key);
+      throw new Error('Should have thrown error for invalid JSON');
+    } catch (error) {
+      if (!error || !(error as Error).message.includes('decryption failed')) {
+        throw new Error('Should throw appropriate decryption error');
+      }
+    }
+
+    try {
+      const fakeEncrypted = JSON.stringify({ data: 'fake', iv: 'fake', tag: 'fake' });
+      FieldEncryption.decryptField(fakeEncrypted, key);
+      throw new Error('Should have thrown error for invalid encrypted data');
+    } catch (error) {
+      if (!error || !(error as Error).message.includes('Decryption failed')) {
+        throw new Error('Should throw appropriate error for corrupted data');
+      }
+    }
+  }
+
+  private async testPerformance(): Promise<void> {
+    const testData = 'Performance test data that is reasonably long to simulate real SSH keys and passwords.';
+    const key = FieldEncryption.getFieldKey(this.testPassword, 'performance-test');
+
+    const iterations = 100;
+    const startTime = Date.now();
+
+    for (let i = 0; i < iterations; i++) {
+      const encrypted = FieldEncryption.encryptField(testData, key);
+      const decrypted = FieldEncryption.decryptField(encrypted, key);
+
+      if (decrypted !== testData) {
+        throw new Error(`Performance test failed at iteration ${i}`);
+      }
+    }
+
+    const endTime = Date.now();
+    const totalTime = endTime - startTime;
+    const avgTime = totalTime / iterations;
+
+    console.log(`   ⚡ Performance: ${iterations} encrypt/decrypt cycles in ${totalTime}ms (${avgTime.toFixed(2)}ms avg)`);
+
+    if (avgTime > 50) {
+      console.log('   ⚠️  Warning: Encryption operations are slower than expected');
+    }
+  }
+
+  static async validateProduction(): Promise<boolean> {
+    console.log('🔒 Validating production encryption setup...\n');
+
+    try {
+      const encryptionKey = process.env.DB_ENCRYPTION_KEY;
+
+      if (!encryptionKey) {
+        console.log('❌ DB_ENCRYPTION_KEY environment variable not set');
+        return false;
+      }
+
+      if (encryptionKey === 'default-key-change-me') {
+        console.log('❌ DB_ENCRYPTION_KEY is using default value (INSECURE)');
+        return false;
+      }
+
+      if (encryptionKey.length < 16) {
+        console.log('❌ DB_ENCRYPTION_KEY is too short (minimum 16 characters)');
+        return false;
+      }
+
+      DatabaseEncryption.initialize({
+        masterPassword: encryptionKey,
+        encryptionEnabled: true
+      });
+
+      const status = DatabaseEncryption.getEncryptionStatus();
+      if (!status.configValid) {
+        console.log('❌ Encryption configuration validation failed');
+        return false;
+      }
+
+      console.log('✅ Production encryption setup is valid');
+      return true;
+
+    } catch (error) {
+      console.log(`❌ Production validation failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+      return false;
+    }
+  }
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const testMode = process.argv[2];
+
+  if (testMode === 'production') {
+    EncryptionTest.validateProduction()
+      .then((success) => {
+        process.exit(success ? 0 : 1);
+      })
+      .catch((error) => {
+        console.error('Test execution failed:', error);
+        process.exit(1);
+      });
+  } else {
+    const test = new EncryptionTest();
+    test.runAllTests()
+      .then((success) => {
+        process.exit(success ? 0 : 1);
+      })
+      .catch((error) => {
+        console.error('Test execution failed:', error);
+        process.exit(1);
+      });
+  }
+}
+
+export { EncryptionTest };
\ No newline at end of file
diff --git a/src/backend/utils/master-key-protection.ts b/src/backend/utils/master-key-protection.ts
new file mode 100644
index 00000000..ac64a0f3
--- /dev/null
+++ b/src/backend/utils/master-key-protection.ts
@@ -0,0 +1,240 @@
+import crypto from 'crypto';
+import os from 'os';
+import fs from 'fs';
+import path from 'path';
+import { databaseLogger } from './logger.js';
+
+interface ProtectedKeyData {
+  data: string;
+  iv: string;
+  tag: string;
+  version: string;
+  fingerprint: string;
+}
+
+class MasterKeyProtection {
+  private static readonly VERSION = 'v1';
+  private static readonly KEK_SALT = 'termix-kek-salt-v1';
+  private static readonly KEK_ITERATIONS = 50000;
+
+  private static generateDeviceFingerprint(): string {
+    try {
+      const features = [
+        os.hostname(),
+        os.platform(),
+        os.arch(),
+        process.cwd(),
+        this.getFileSystemFingerprint(),
+        this.getNetworkFingerprint()
+      ];
+
+      const fingerprint = crypto.createHash('sha256')
+        .update(features.join('|'))
+        .digest('hex');
+
+      databaseLogger.debug('Generated device fingerprint', {
+        operation: 'fingerprint_generation',
+        fingerprintPrefix: fingerprint.substring(0, 8)
+      });
+
+      return fingerprint;
+    } catch (error) {
+      databaseLogger.error('Failed to generate device fingerprint', error, {
+        operation: 'fingerprint_generation_failed'
+      });
+      throw new Error('Device fingerprint generation failed');
+    }
+  }
+
+  private static getFileSystemFingerprint(): string {
+    try {
+      const stat = fs.statSync(process.cwd());
+      return `${stat.ino}-${stat.dev}`;
+    } catch {
+      return 'fs-unknown';
+    }
+  }
+
+  private static getNetworkFingerprint(): string {
+    try {
+      const networkInterfaces = os.networkInterfaces();
+      const macAddresses = [];
+
+      for (const interfaceName in networkInterfaces) {
+        const interfaces = networkInterfaces[interfaceName];
+        if (interfaces) {
+          for (const iface of interfaces) {
+            if (!iface.internal && iface.mac && iface.mac !== '00:00:00:00:00:00') {
+              macAddresses.push(iface.mac);
+            }
+          }
+        }
+      }
+
+      // 使用第一个有效的MAC地址，如果没有则使用fallback
+      return macAddresses.length > 0 ? macAddresses.sort()[0] : 'no-mac-found';
+    } catch {
+      return 'network-unknown';
+    }
+  }
+
+
+  private static deriveKEK(): Buffer {
+    const fingerprint = this.generateDeviceFingerprint();
+    const salt = Buffer.from(this.KEK_SALT);
+
+    const kek = crypto.pbkdf2Sync(
+      fingerprint,
+      salt,
+      this.KEK_ITERATIONS,
+      32,
+      'sha256'
+    );
+
+    databaseLogger.debug('Derived KEK from device fingerprint', {
+      operation: 'kek_derivation',
+      iterations: this.KEK_ITERATIONS
+    });
+
+    return kek;
+  }
+
+  static encryptMasterKey(masterKey: string): string {
+    if (!masterKey) {
+      throw new Error('Master key cannot be empty');
+    }
+
+    try {
+      const kek = this.deriveKEK();
+      const iv = crypto.randomBytes(16);
+      const cipher = crypto.createCipheriv('aes-256-gcm', kek, iv) as any;
+
+      let encrypted = cipher.update(masterKey, 'hex', 'hex');
+      encrypted += cipher.final('hex');
+      const tag = cipher.getAuthTag();
+
+      const protectedData: ProtectedKeyData = {
+        data: encrypted,
+        iv: iv.toString('hex'),
+        tag: tag.toString('hex'),
+        version: this.VERSION,
+        fingerprint: this.generateDeviceFingerprint().substring(0, 16)
+      };
+
+      const result = JSON.stringify(protectedData);
+
+      databaseLogger.info('Master key encrypted with device KEK', {
+        operation: 'master_key_encryption',
+        version: this.VERSION,
+        fingerprintPrefix: protectedData.fingerprint
+      });
+
+      return result;
+    } catch (error) {
+      databaseLogger.error('Failed to encrypt master key', error, {
+        operation: 'master_key_encryption_failed'
+      });
+      throw new Error('Master key encryption failed');
+    }
+  }
+
+  static decryptMasterKey(encryptedKey: string): string {
+    if (!encryptedKey) {
+      throw new Error('Encrypted key cannot be empty');
+    }
+
+    try {
+      const protectedData: ProtectedKeyData = JSON.parse(encryptedKey);
+
+      if (protectedData.version !== this.VERSION) {
+        throw new Error(`Unsupported protection version: ${protectedData.version}`);
+      }
+
+      const currentFingerprint = this.generateDeviceFingerprint().substring(0, 16);
+      if (protectedData.fingerprint !== currentFingerprint) {
+        databaseLogger.warn('Device fingerprint mismatch detected', {
+          operation: 'master_key_decryption',
+          expected: protectedData.fingerprint,
+          current: currentFingerprint
+        });
+        throw new Error('Device fingerprint mismatch - key was encrypted on different machine');
+      }
+
+      const kek = this.deriveKEK();
+      const decipher = crypto.createDecipheriv('aes-256-gcm', kek, Buffer.from(protectedData.iv, 'hex')) as any;
+      decipher.setAuthTag(Buffer.from(protectedData.tag, 'hex'));
+
+      let decrypted = decipher.update(protectedData.data, 'hex', 'hex');
+      decrypted += decipher.final('hex');
+
+      databaseLogger.debug('Master key decrypted successfully', {
+        operation: 'master_key_decryption',
+        version: protectedData.version
+      });
+
+      return decrypted;
+    } catch (error) {
+      databaseLogger.error('Failed to decrypt master key', error, {
+        operation: 'master_key_decryption_failed'
+      });
+      throw new Error(`Master key decryption failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+  }
+
+  static isProtectedKey(data: string): boolean {
+    try {
+      const parsed = JSON.parse(data);
+      return !!(parsed.data && parsed.iv && parsed.tag && parsed.version && parsed.fingerprint);
+    } catch {
+      return false;
+    }
+  }
+
+  static validateProtection(): boolean {
+    try {
+      const testKey = crypto.randomBytes(32).toString('hex');
+      const encrypted = this.encryptMasterKey(testKey);
+      const decrypted = this.decryptMasterKey(encrypted);
+
+      const isValid = decrypted === testKey;
+
+      databaseLogger.info('Master key protection validation completed', {
+        operation: 'protection_validation',
+        result: isValid ? 'passed' : 'failed'
+      });
+
+      return isValid;
+    } catch (error) {
+      databaseLogger.error('Master key protection validation failed', error, {
+        operation: 'protection_validation_failed'
+      });
+      return false;
+    }
+  }
+
+  static getProtectionInfo(encryptedKey: string): {
+    version: string;
+    fingerprint: string;
+    isCurrentDevice: boolean;
+  } | null {
+    try {
+      if (!this.isProtectedKey(encryptedKey)) {
+        return null;
+      }
+
+      const protectedData: ProtectedKeyData = JSON.parse(encryptedKey);
+      const currentFingerprint = this.generateDeviceFingerprint().substring(0, 16);
+
+      return {
+        version: protectedData.version,
+        fingerprint: protectedData.fingerprint,
+        isCurrentDevice: protectedData.fingerprint === currentFingerprint
+      };
+    } catch {
+      return null;
+    }
+  }
+}
+
+export { MasterKeyProtection };
+export type { ProtectedKeyData };
\ No newline at end of file
diff --git a/src/locales/en/translation.json b/src/locales/en/translation.json
index 1926015a..275c7645 100644
--- a/src/locales/en/translation.json
+++ b/src/locales/en/translation.json
@@ -373,7 +373,47 @@
     "deleteUser": "Delete user {{username}}? This cannot be undone.",
     "userDeletedSuccessfully": "User {{username}} deleted successfully",
     "failedToDeleteUser": "Failed to delete user",
-    "overrideUserInfoUrl": "Override User Info URL (not required)"
+    "overrideUserInfoUrl": "Override User Info URL (not required)",
+    "databaseSecurity": "Database Security",
+    "encryptionStatus": "Encryption Status",
+    "enabled": "Enabled",
+    "disabled": "Disabled",
+    "keyId": "Key ID",
+    "created": "Created",
+    "migrationStatus": "Migration Status",
+    "migrationCompleted": "Migration completed",
+    "migrationRequired": "Migration required",
+    "deviceProtectedMasterKey": "Device-Protected Master Key",
+    "legacyKeyStorage": "Legacy Key Storage",
+    "masterKeyEncryptedWithDeviceFingerprint": "Master key encrypted with device fingerprint (KEK protection active)",
+    "keyNotProtectedByDeviceBinding": "Key not protected by device binding (upgrade recommended)",
+    "valid": "Valid",
+    "initializeDatabaseEncryption": "Initialize Database Encryption",
+    "enableAes256EncryptionWithDeviceBinding": "Enable AES-256 encryption with device-bound master key protection. This creates enterprise-grade security for SSH keys, passwords, and authentication tokens.",
+    "featuresEnabled": "Features enabled:",
+    "aes256GcmAuthenticatedEncryption": "AES-256-GCM authenticated encryption",
+    "deviceFingerprintMasterKeyProtection": "Device fingerprint master key protection (KEK)",
+    "pbkdf2KeyDerivation": "PBKDF2 key derivation with 100K iterations",
+    "automaticKeyManagement": "Automatic key management and rotation",
+    "initializing": "Initializing...",
+    "initializeEnterpriseEncryption": "Initialize Enterprise Encryption",
+    "migrateExistingData": "Migrate Existing Data",
+    "encryptExistingUnprotectedData": "Encrypt existing unprotected data in your database. This process is safe and creates automatic backups.",
+    "testMigrationDryRun": "Test Migration (Dry Run)",
+    "migrating": "Migrating...",
+    "migrateData": "Migrate Data",
+    "securityInformation": "Security Information",
+    "sshPrivateKeysEncryptedWithAes256": "SSH private keys and passwords are encrypted with AES-256-GCM",
+    "userAuthTokensProtected": "User authentication tokens and 2FA secrets are protected",
+    "masterKeysProtectedByDeviceFingerprint": "Master encryption keys are protected by device fingerprint (KEK)",
+    "keysBoundToServerInstance": "Keys are bound to this specific server instance",
+    "pbkdf2HkdfKeyDerivation": "PBKDF2 + HKDF key derivation with 100K iterations",
+    "backwardCompatibleMigration": "All data remains backward compatible during migration",
+    "enterpriseGradeSecurityActive": "Enterprise-Grade Security Active",
+    "masterKeysProtectedByDeviceBinding": "Your master encryption keys are protected by device fingerprint binding. This means even if someone gains access to your database files, they cannot decrypt the data without physical access to this server.",
+    "important": "Important",
+    "keepEncryptionKeysSecure": "Keep your encryption keys secure. Loss of encryption keys will result in permanent data loss. Regular backups are recommended.",
+    "loadingEncryptionStatus": "Loading encryption status..."
   },
   "hosts": {
     "title": "Host Manager",
diff --git a/src/locales/zh/translation.json b/src/locales/zh/translation.json
index e9b168a6..127c32ad 100644
--- a/src/locales/zh/translation.json
+++ b/src/locales/zh/translation.json
@@ -359,7 +359,47 @@
     "failedToRemoveAdminStatus": "移除管理员权限失败",
     "userDeletedSuccessfully": "用户 {{username}} 删除成功",
     "failedToDeleteUser": "删除用户失败",
-    "overrideUserInfoUrl": "覆盖用户信息 URL（非必填）"
+    "overrideUserInfoUrl": "覆盖用户信息 URL（非必填）",
+    "databaseSecurity": "数据库安全",
+    "encryptionStatus": "加密状态",
+    "enabled": "已启用",
+    "disabled": "已禁用",
+    "keyId": "密钥 ID",
+    "created": "创建时间",
+    "migrationStatus": "迁移状态",
+    "migrationCompleted": "迁移完成",
+    "migrationRequired": "需要迁移",
+    "deviceProtectedMasterKey": "设备保护主密钥",
+    "legacyKeyStorage": "传统密钥存储",
+    "masterKeyEncryptedWithDeviceFingerprint": "主密钥已通过设备指纹加密（KEK 保护已激活）",
+    "keyNotProtectedByDeviceBinding": "密钥未受设备绑定保护（建议升级）",
+    "valid": "有效",
+    "initializeDatabaseEncryption": "初始化数据库加密",
+    "enableAes256EncryptionWithDeviceBinding": "启用具有设备绑定主密钥保护的 AES-256 加密。这为 SSH 密钥、密码和身份验证令牌创建企业级安全保护。",
+    "featuresEnabled": "启用的功能：",
+    "aes256GcmAuthenticatedEncryption": "AES-256-GCM 认证加密",
+    "deviceFingerprintMasterKeyProtection": "设备指纹主密钥保护 (KEK)",
+    "pbkdf2KeyDerivation": "PBKDF2 密钥推导（10万次迭代）",
+    "automaticKeyManagement": "自动密钥管理和轮换",
+    "initializing": "初始化中...",
+    "initializeEnterpriseEncryption": "初始化企业级加密",
+    "migrateExistingData": "迁移现有数据",
+    "encryptExistingUnprotectedData": "加密数据库中现有的未保护数据。此过程安全可靠，会自动创建备份。",
+    "testMigrationDryRun": "测试迁移（演习模式）",
+    "migrating": "迁移中...",
+    "migrateData": "迁移数据",
+    "securityInformation": "安全信息",
+    "sshPrivateKeysEncryptedWithAes256": "SSH 私钥和密码使用 AES-256-GCM 加密",
+    "userAuthTokensProtected": "用户认证令牌和 2FA 密钥受到保护",
+    "masterKeysProtectedByDeviceFingerprint": "主加密密钥受设备指纹保护 (KEK)",
+    "keysBoundToServerInstance": "密钥绑定到此特定服务器实例",
+    "pbkdf2HkdfKeyDerivation": "PBKDF2 + HKDF 密钥推导（10万次迭代）",
+    "backwardCompatibleMigration": "迁移过程中所有数据保持向后兼容",
+    "enterpriseGradeSecurityActive": "企业级安全已激活",
+    "masterKeysProtectedByDeviceBinding": "您的主加密密钥受设备指纹绑定保护。这意味着即使有人获得您的数据库文件访问权限，如果没有对此服务器的物理访问权限，他们也无法解密数据。",
+    "important": "重要提示",
+    "keepEncryptionKeysSecure": "请妥善保管您的加密密钥。丢失加密密钥将导致永久性数据丢失。建议定期备份。",
+    "loadingEncryptionStatus": "正在加载加密状态..."
   },
   "hosts": {
     "title": "主机管理",
diff --git a/src/ui/Desktop/Admin/AdminSettings.tsx b/src/ui/Desktop/Admin/AdminSettings.tsx
index 8b2f8cc9..7d0e8c6b 100644
--- a/src/ui/Desktop/Admin/AdminSettings.tsx
+++ b/src/ui/Desktop/Admin/AdminSettings.tsx
@@ -21,7 +21,7 @@ import {
   TableHeader,
   TableRow,
 } from "@/components/ui/table.tsx";
-import { Shield, Trash2, Users } from "lucide-react";
+import { Shield, Trash2, Users, Database, Key, Lock } from "lucide-react";
 import { toast } from "sonner";
 import { useTranslation } from "react-i18next";
 import { useConfirmation } from "@/hooks/use-confirmation.ts";
@@ -82,6 +82,12 @@ export function AdminSettings({
     null,
   );
 
+  // Database encryption state
+  const [encryptionStatus, setEncryptionStatus] = React.useState<any>(null);
+  const [encryptionLoading, setEncryptionLoading] = React.useState(false);
+  const [migrationLoading, setMigrationLoading] = React.useState(false);
+  const [migrationProgress, setMigrationProgress] = React.useState<string>("");
+
   React.useEffect(() => {
     const jwt = getCookie("jwt");
     if (!jwt) return;
@@ -103,6 +109,7 @@ export function AdminSettings({
         }
       });
     fetchUsers();
+    fetchEncryptionStatus();
   }, []);
 
   React.useEffect(() => {
@@ -251,6 +258,105 @@ export function AdminSettings({
     );
   };
 
+  const fetchEncryptionStatus = async () => {
+    if (isElectron()) {
+      const serverUrl = (window as any).configuredServerUrl;
+      if (!serverUrl) return;
+    }
+
+    try {
+      const jwt = getCookie("jwt");
+      const apiUrl = isElectron()
+        ? `${(window as any).configuredServerUrl}/encryption/status`
+        : "http://localhost:8081/encryption/status";
+
+      const response = await fetch(apiUrl, {
+        headers: {
+          "Authorization": `Bearer ${jwt}`,
+          "Content-Type": "application/json"
+        }
+      });
+
+      if (response.ok) {
+        const data = await response.json();
+        setEncryptionStatus(data);
+      }
+    } catch (err) {
+      console.error("Failed to fetch encryption status:", err);
+    }
+  };
+
+  const handleInitializeEncryption = async () => {
+    setEncryptionLoading(true);
+    try {
+      const jwt = getCookie("jwt");
+      const apiUrl = isElectron()
+        ? `${(window as any).configuredServerUrl}/encryption/initialize`
+        : "http://localhost:8081/encryption/initialize";
+
+      const response = await fetch(apiUrl, {
+        method: "POST",
+        headers: {
+          "Authorization": `Bearer ${jwt}`,
+          "Content-Type": "application/json"
+        },
+      });
+
+      if (response.ok) {
+        const result = await response.json();
+        toast.success("Database encryption initialized successfully!");
+        await fetchEncryptionStatus();
+      } else {
+        throw new Error("Failed to initialize encryption");
+      }
+    } catch (err) {
+      toast.error("Failed to initialize encryption");
+    } finally {
+      setEncryptionLoading(false);
+    }
+  };
+
+  const handleMigrateData = async (dryRun: boolean = false) => {
+    setMigrationLoading(true);
+    setMigrationProgress(dryRun ? "Running dry run..." : "Starting migration...");
+
+    try {
+      const jwt = getCookie("jwt");
+      const apiUrl = isElectron()
+        ? `${(window as any).configuredServerUrl}/encryption/migrate`
+        : "http://localhost:8081/encryption/migrate";
+
+      const response = await fetch(apiUrl, {
+        method: "POST",
+        headers: {
+          "Authorization": `Bearer ${jwt}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ dryRun }),
+      });
+
+      if (response.ok) {
+        const result = await response.json();
+        if (dryRun) {
+          toast.success("Dry run completed - no data was changed");
+          setMigrationProgress("Dry run completed");
+        } else {
+          toast.success("Data migration completed successfully!");
+          setMigrationProgress("Migration completed");
+          await fetchEncryptionStatus();
+        }
+      } else {
+        throw new Error("Migration failed");
+      }
+    } catch (err) {
+      toast.error(dryRun ? "Dry run failed" : "Migration failed");
+      setMigrationProgress("Failed");
+    } finally {
+      setMigrationLoading(false);
+      setTimeout(() => setMigrationProgress(""), 3000);
+    }
+  };
+
   const topMarginPx = isTopbarOpen ? 74 : 26;
   const leftMarginPx = sidebarState === "collapsed" ? 26 : 8;
   const bottomMarginPx = 8;
@@ -295,6 +401,10 @@ export function AdminSettings({
                 <Shield className="h-4 w-4" />
                 {t("admin.adminManagement")}
               </TabsTrigger>
+              <TabsTrigger value="security" className="flex items-center gap-2">
+                <Database className="h-4 w-4" />
+{t("admin.databaseSecurity")}
+              </TabsTrigger>
             </TabsList>
 
             <TabsContent value="registration" className="space-y-6">
@@ -680,6 +790,213 @@ export function AdminSettings({
                 </div>
               </div>
             </TabsContent>
+
+            <TabsContent value="security" className="space-y-6">
+              <div className="space-y-6">
+                <div className="flex items-center gap-2">
+                  <Database className="h-5 w-5" />
+                  <h3 className="text-lg font-semibold">Database Encryption</h3>
+                </div>
+
+                {encryptionStatus && (
+                  <div className="space-y-4">
+                    <div className="p-4 border rounded-md bg-muted/50">
+                      <div className="space-y-3">
+                        <div className="flex items-center gap-2">
+                          {encryptionStatus.encryption?.enabled ? (
+                            <Lock className="h-4 w-4 text-green-600" />
+                          ) : (
+                            <Key className="h-4 w-4 text-yellow-600" />
+                          )}
+                          <span className="font-medium">
+                            {t("admin.encryptionStatus")}: {" "}
+                            {encryptionStatus.encryption?.enabled ? (
+                              <span className="text-green-600">{t("admin.enabled")}</span>
+                            ) : (
+                              <span className="text-yellow-600">{t("admin.disabled")}</span>
+                            )}
+                          </span>
+                        </div>
+
+                        {encryptionStatus.encryption?.key && (
+                          <div className="space-y-3">
+                            <div className="grid grid-cols-2 gap-4 text-sm">
+                              <div>
+                                <span className="text-muted-foreground">{t("admin.keyId")}:</span>
+                                <div className="font-mono text-xs bg-background rounded px-2 py-1 mt-1">
+                                  {encryptionStatus.encryption.key.keyId || "Not available"}
+                                </div>
+                              </div>
+                              <div>
+                                <span className="text-muted-foreground">{t("admin.created")}:</span>
+                                <div className="text-xs mt-1">
+                                  {encryptionStatus.encryption.key.createdAt
+                                    ? new Date(encryptionStatus.encryption.key.createdAt).toLocaleDateString()
+                                    : "Not available"}
+                                </div>
+                              </div>
+                            </div>
+
+                            {/* KEK Protection Status */}
+                            <div className="flex items-center gap-2 p-2 rounded-md bg-background border">
+                              {encryptionStatus.encryption.key.kekProtected ? (
+                                <>
+                                  <Shield className="h-4 w-4 text-green-600" />
+                                  <div className="flex-1">
+                                    <div className="text-sm font-medium text-green-600">
+                                      {t("admin.deviceProtectedMasterKey")}
+                                    </div>
+                                    <div className="text-xs text-muted-foreground">
+                                      {t("admin.masterKeyEncryptedWithDeviceFingerprint")}
+                                    </div>
+                                  </div>
+                                </>
+                              ) : (
+                                <>
+                                  <Shield className="h-4 w-4 text-yellow-600" />
+                                  <div className="flex-1">
+                                    <div className="text-sm font-medium text-yellow-600">
+                                      {t("admin.legacyKeyStorage")}
+                                    </div>
+                                    <div className="text-xs text-muted-foreground">
+                                      {t("admin.keyNotProtectedByDeviceBinding")}
+                                    </div>
+                                  </div>
+                                </>
+                              )}
+                              {encryptionStatus.encryption.key.kekValid && (
+                                <div className="text-xs text-green-600 font-medium">✓ {t("admin.valid")}</div>
+                              )}
+                            </div>
+                          </div>
+                        )}
+
+                        <div className="text-sm">
+                          <span className="text-muted-foreground">{t("admin.migrationStatus")}:</span>
+                          <div className="mt-1">
+                            {encryptionStatus.migration?.migrationCompleted ? (
+                              <span className="text-green-600">✓ {t("admin.migrationCompleted")}</span>
+                            ) : (
+                              <span className="text-yellow-600">⚠ {t("admin.migrationRequired")}</span>
+                            )}
+                          </div>
+                        </div>
+                      </div>
+                    </div>
+
+                    <div className="space-y-4">
+                      {!encryptionStatus.encryption?.key?.hasKey ? (
+                        <div className="space-y-3">
+                          <h4 className="font-medium">{t("admin.initializeDatabaseEncryption")}</h4>
+                          <p className="text-sm text-muted-foreground">
+                            {t("admin.enableAes256EncryptionWithDeviceBinding")}
+                                                      </p>
+                          <div className="p-3 bg-blue-50 border border-blue-200 rounded-md">
+                            <div className="text-sm text-blue-800">
+                              <div className="font-medium">{t("admin.featuresEnabled")}</div>
+                              <div className="mt-1 space-y-1 text-xs">
+                                <div>• {t("admin.aes256GcmAuthenticatedEncryption")}</div>
+                                <div>• {t("admin.deviceFingerprintMasterKeyProtection")}</div>
+                                <div>• {t("admin.pbkdf2KeyDerivation")}</div>
+                                <div>• {t("admin.automaticKeyManagement")}</div>
+                              </div>
+                            </div>
+                          </div>
+                          <Button
+                            onClick={handleInitializeEncryption}
+                            disabled={encryptionLoading}
+                            className="flex items-center gap-2"
+                          >
+                            <Shield className="h-4 w-4" />
+                            {encryptionLoading ? t("admin.initializing") : t("admin.initializeEnterpriseEncryption")}
+                          </Button>
+                        </div>
+                      ) : (
+                        <div className="space-y-4">
+                          {!encryptionStatus.migration?.migrationCompleted && (
+                            <div className="space-y-3">
+                              <h4 className="font-medium">{t("admin.migrateExistingData")}</h4>
+                              <p className="text-sm text-muted-foreground">
+                                {t("admin.encryptExistingUnprotectedData")}
+                              </p>
+
+                              {migrationProgress && (
+                                <div className="p-3 bg-blue-50 border border-blue-200 rounded-md">
+                                  <div className="text-sm text-blue-800">{migrationProgress}</div>
+                                </div>
+                              )}
+
+                              <div className="flex gap-2">
+                                <Button
+                                  onClick={() => handleMigrateData(true)}
+                                  disabled={migrationLoading}
+                                  variant="outline"
+                                  size="sm"
+                                >
+                                  {t("admin.testMigrationDryRun")}
+                                </Button>
+                                <Button
+                                  onClick={() => handleMigrateData(false)}
+                                  disabled={migrationLoading}
+                                  className="flex items-center gap-2"
+                                >
+                                  <Database className="h-4 w-4" />
+                                  {migrationLoading ? t("admin.migrating") : t("admin.migrateData")}
+                                </Button>
+                              </div>
+                            </div>
+                          )}
+
+                          <div className="space-y-3">
+                            <h4 className="font-medium">{t("admin.securityInformation")}</h4>
+                            <div className="text-sm space-y-2 text-muted-foreground">
+                              <div>• {t("admin.sshPrivateKeysEncryptedWithAes256")}</div>
+                              <div>• {t("admin.userAuthTokensProtected")}</div>
+                              <div>• {t("admin.masterKeysProtectedByDeviceFingerprint")}</div>
+                              <div>• {t("admin.keysBoundToServerInstance")}</div>
+                              <div>• {t("admin.pbkdf2HkdfKeyDerivation")}</div>
+                              <div>• {t("admin.backwardCompatibleMigration")}</div>
+                            </div>
+
+                            {encryptionStatus.encryption?.key?.kekProtected && (
+                              <div className="p-3 bg-green-50 border border-green-200 rounded-md">
+                                <div className="flex items-start gap-2">
+                                  <Shield className="h-4 w-4 text-green-600 mt-0.5" />
+                                  <div className="text-sm">
+                                    <div className="font-medium text-green-800">{t("admin.enterpriseGradeSecurityActive")}</div>
+                                    <div className="text-green-700 mt-1">
+                                      {t("admin.masterKeysProtectedByDeviceBinding")}
+                                                                                                                </div>
+                                  </div>
+                                </div>
+                              </div>
+                            )}
+                          </div>
+
+                          <div className="p-4 border border-yellow-200 bg-yellow-50 rounded-md">
+                            <div className="flex items-start gap-2">
+                              <Shield className="h-4 w-4 text-yellow-600 mt-0.5" />
+                              <div className="text-sm">
+                                <div className="font-medium text-yellow-800">{t("admin.important")}</div>
+                                <div className="text-yellow-700 mt-1">
+                                  {t("admin.keepEncryptionKeysSecure")}
+                                                                  </div>
+                              </div>
+                            </div>
+                          </div>
+                        </div>
+                      )}
+                    </div>
+                  </div>
+                )}
+
+                {!encryptionStatus && (
+                  <div className="text-center py-8">
+                    <div className="text-muted-foreground">{t("admin.loadingEncryptionStatus")}</div>
+                  </div>
+                )}
+              </div>
+            </TabsContent>
           </Tabs>
         </div>
       </div>