Say I made a simple program that takes a file .dat that is encrypted in Binary Format, then I decrypt it into a byte array and then everything is rewritten again into the file decrypted.

For Example:

I've made a binary encryption algorithm. => 0100100001100101001000000110100001100101011000...

But this is very very easy to decrypt...

Is there any way, that, if it's possible does not need any sort of key, to encrypt my save progress?

  • 15
    \$\begingroup\$ Are you sure that you want to encrypt saves? There are easier ways to cheat, for example when using memory modification. I would just compress them with zlib (put them into .gz), it would reduce size and prevent some of possible cheaters from modifying it. \$\endgroup\$ Jan 23, 2016 at 12:43
  • 37
    \$\begingroup\$ Nitpicking: What you are doing is an encoding, not an encryption. \$\endgroup\$
    – Philipp
    Jan 23, 2016 at 14:23
  • 13
    \$\begingroup\$ (assuming this is for single player) Don't try to prevent cheating in a single player game, it's annoying both for you and for the player. And is ultimately useless. \$\endgroup\$
    – user15805
    Jan 23, 2016 at 15:29
  • 7
    \$\begingroup\$ It is not possible to encrypt save files so that the user can't read or modify them. (Because, for example, they could just pause your game in a debugger right after it does the decryption!). However, you can make it harder (because opening a plain text file is really easy compared to finding the right moment to pause the game in a debugger). Is that what you're trying to do? \$\endgroup\$ Jan 24, 2016 at 9:23
  • 6
    \$\begingroup\$ @DanielBejar I just told you, you can't make it impossible, you can only make it harder. \$\endgroup\$ Jan 24, 2016 at 11:52

4 Answers 4


In general you should never invent your own cryptographic algorithms, unless you have at least a PhD in both mathematics and computer science. But there are many good stock algorithms which have no known attacks and have free implementations in many programming languages. For example RC5, AES or Blowfish. Depending on which technology you use to develop your game, it might even offer secure encryption out-of-the-box.

However, the question is if encrypting savegames is a good idea.

First, when you have your game executable do the encryption and decryption, you have to include both the algorithm and the key in your game executable. That means a determined hacker can find them, extract them, and use them to build a savegame editor. So it can never be 100% secure.

Second, why do you want to do this anyway? When it is an online game, you should store the gamestate online where the players can not modify it. When it is an offline game, then why bother? A cheater can only hurt their own game experience at worst. The honest players who want to enjoy your game as intended won't be affected by this at all. On the other hand, allowing players to cheat can add value to your game. It allows players to experience the game in a different way which can just increase their long-term enjoyment of your game.

  • 5
    \$\begingroup\$ Though I can't imagine someone coming up with something good in a few hours time. And you'd be wasting resources on something that you probably don't need. \$\endgroup\$
    – Aistis
    Jan 23, 2016 at 20:49
  • 6
    \$\begingroup\$ "When it is an offline game, then why bother?" What if it's a single-player game with online highscores? \$\endgroup\$ Jan 24, 2016 at 5:01
  • 19
    \$\begingroup\$ "allowing players to cheat can add value to your game" - upvoted for this statement. I am really annoyed by games that decide to lock parts of the experience that I paid for until I achieve a certain level of mastery, and I am glad that in these cases, there are cheats available to unlock the full game. For instance, I am totally lost in the racing tournaments against the AI in the older Need for Speed parts; to me, the enjoyment was rather in driving through the varied landscapes, hence I usually skip the racing and unlock all maps and cars. A game that prevents this would just annoy me. \$\endgroup\$ Jan 24, 2016 at 11:44
  • 7
    \$\begingroup\$ I would like "unless you have at least a PhD in both mathematics and computer science" rewritten as "unless you have at least the knowledge that would be required to gain a PhD in both mathematics and computer science" (and even then, at least in Germany, courses are often full of stuff not related to crypto). One does not inherently need a degree to outperform PhDs. \$\endgroup\$
    – phresnel
    Jan 25, 2016 at 8:56
  • 5
    \$\begingroup\$ @phresnel While you're technically right, a PhD is a standard metric of one's mastery of a theoretical subject, as awarded by trusted institutions. So it makes sense to use it as a shorthand for the amount of knowledge and skill needed to achieve the PhD. In other words: what the OP meant is clear enough :-) \$\endgroup\$
    – Tobia
    Jan 25, 2016 at 11:59

To encrypt and decrypt locally, you will need to store the key in your program, so people will be able to crack the encryption if they disassemble your code. There are tricks to obfuscate keys, but even with those a dedicated attacker will find the key and then post it online for all those who are less dedicated to see. The only thing encryption does prevent is people who use a hex editor - you can easily foil that with compression and anything that makes the file unreadable by an unzip program. E.g. add one byte in front of the data.

Alternatively you can append the md5 of the savefile at the end of the file, so you'll notice if a file has been tampered with. You can then use this to either refuse loading the savegame, or to flag support tickets appropriately so you don't waste time on issues caused by manually modified savegames. Again, this is trivial to circumvent by anyone who can read your code.

If you want something that can't be circumvented by someone who has access to the binaries on their device, you need to run part of the program on a server, which is under your control.

To answer your last question, a key plus encryption type just identifies the exact algorithm that needs to be applied to encrypt/decrypt. You cannot encrypt/decrypt data without an algorithm that defines how to do so.

  • \$\begingroup\$ Your second point is nice. It could also help track problems in the case of file corruption. \$\endgroup\$ Feb 12, 2016 at 9:13

Store a transformed SHA256 hash of the actual save data in the save file.

Compare the stored hash to the SHA256 value of the data as you load it.

If that doesn't match, they've cheated or corrupted the file.

Edit to clarify: this makes it more difficult to crack the anti-cheat system but still possible.

  • 7
    \$\begingroup\$ Nothing stops people from recalculating the hash after they made the modifications. Also, I don't understand why there are still people who advocate the broken MD5 algorithm with all its known cryptographic weaknesses when there are far better alternatives like SHA-256 (for signatures) or bcrypt (for passwords). \$\endgroup\$
    – Philipp
    Jan 23, 2016 at 14:50
  • 1
    \$\begingroup\$ Simple, fast, and completely broken. \$\endgroup\$
    – DeadMG
    Jan 23, 2016 at 15:30
  • 2
    \$\begingroup\$ @DeadMG It's broken by design, because the user has access to the binaries which must contain the key. Using a stronger hash or encrypting the file with something like AES would be a waste of resources, and bad design, because it provides no added security, but does add cost. +1 because the downvote is undeserved. \$\endgroup\$
    – Peter
    Jan 23, 2016 at 16:36
  • 7
    \$\begingroup\$ @Philipp because in this case MD5 is clearly superior to SHA-256. What is required by the described approach is a cheap checksum algorithm, which is exactly what MD5 is. \$\endgroup\$
    – Peter
    Jan 23, 2016 at 16:48
  • 3
    \$\begingroup\$ @transistor09 if it's purely client side, we can't ensure anything and a checksum works just as well as having the client encrypt the whole thing. Either way, it can be cracked. \$\endgroup\$
    – Lucien
    Jan 24, 2016 at 14:46

I would use a standard encryption algorithm (because it makes it harder to perform crypto-analysis on the saved file) but not one of the top five most used, and hide it throughout your code (because it makes it harder to understand what algorithm it is and where is the key.)

To hide the encryption algorithm into your code: take an open source version, understand its flow (which functions call which others an in what sequence), then rename all variables, struct fields and function names (just to be sure) and spread the functions all over your codebase, in different objects and modules, possibly separating their execution temporally as well (perform one piece of the encryption, then do something else, then after some ms come back to it from a seemingly unrelated piece of code and perform another phase of the encryption, and so on.) The key can be hidden in the same way, as a number of seemingly unrelated constants throughout your classes, that are accessed at runtime by the various hidden parts of the encryption algorithm.

Whether all this makes economical sense is another topic altogether.

  • \$\begingroup\$ I don't know... Making it that harder for just a game... But thanks for the help! Ill try my best! \$\endgroup\$ Jan 25, 2016 at 15:19

Not the answer you're looking for? Browse other questions tagged .