A method of encrypting program and other data for non-volatile storage in a flash memory of a host system, wherein a processor in the host system is programmed to write data to the memory and to read data from the memory, comprising: providing a flash memory device including a flash memory, an encryption engine coupled to the flash memory for encrypting data originating from the host system and writing the encrypted data to the memory, and for decrypting data stored in the memory for access by the host system, a static random access memory (SRAM) coupled to the encryption engine for supplying the data from the host system to the encryption engine, and for receiving the decrypted data from the encryption engine for access by the host system, and a key store for holding encryption keys supplied by either a user or the encryption engine, and control circuitry for controlling operation of components of the memory device; the method characterised by the steps of: determining if a valid encryption key is held in the key store; if a valid key is held in the key store, then determining if a program flag is set to indicate that any encrypted data stored in the flash memory is ready to be decrypted; if the program flag is set, transitioning to a first state including writing and reading data to and from the flash memory in accordance with the operation of the host system; and if the program flag is not set, transitioning to a second state including waiting for the program flag to be set, and further including configuring the key store so that if a valid encryption key is not held in store, either (a) transitioning to a third state including creating an encryption key and transitioning to the second state or (b) transitioning to a fourth state including waiting for a valid key to be entered by a user, according to the state of a key select input to the control circuitry. providing a flash memory device including a flash memory, an encryption engine coupled to the flash memory for encrypting data originating from the host system and writing the encrypted data to the memory, and for decrypting data stored in the memory for access by the host system, a static random access memory (SRAM) coupled to the encryption engine for supplying the data from the host system to the encryption engine, and for receiving the decrypted data from the encryption engine for access by the host system, and a key store for holding encryption keys supplied by either a user or the encryption engine, and control circuitry for controlling operation of components of the memory device; the method characterised by the steps of: determining if a valid encryption key is held in the key store; if a valid key is held in the key store, then determining if a program flag is set to indicate that any encrypted data stored in the flash memory is ready to be decrypted; if the program flag is set, transitioning to a first state including writing and reading data to and from the flash memory in accordance with the operation of the host system; and if the program flag is not set, transitioning to a second state determining if a valid encryption key is held in the key store; if a valid key is held in the key store, then determining if a program flag is set to indicate that any encrypted data stored in the flash memory is ready to be decrypted; if the program flag is set, transitioning to a first state including writing and reading data to and from the flash memory in accordance with the operation of the host system; and if the program flag is not set, transitioning to a second state including waiting for the program flag to be set, and further including configuring the key store so that if a valid encryption key is not held in store, either (a) transitioning to a third state including creating an encryption key and transitioning to the second state or (b) transitioning to a fourth state including waiting for a valid key to be entered by a user, according to the state of a key select input to the control circuitry.