move encryption to separate file for sanity