decrypt inline for secrets sync