diff --git a/src/backup/crypto.py b/src/backup/crypto.py
new file mode 100644
index 0000000..f1afa5e
--- /dev/null
+++ b/src/backup/crypto.py
@@ -0,0 +1,9 @@
+from cryptography.fernet import Fernet
+
+
+def encrypt(data: bytes, key: str) -> bytes:
+    return Fernet(key.encode()).encrypt(data)
+
+
+def decrypt(token: bytes, key: str) -> bytes:
+    return Fernet(key.encode()).decrypt(token)
diff --git a/tests/backup/test_crypto.py b/tests/backup/test_crypto.py
new file mode 100644
index 0000000..35d94b6
--- /dev/null
+++ b/tests/backup/test_crypto.py
@@ -0,0 +1,17 @@
+import pytest
+from cryptography.fernet import Fernet
+
+from src.backup.crypto import decrypt, encrypt
+
+
+def test_roundtrip():
+    key = Fernet.generate_key().decode()
+    data = b"contenu de la base sqlite"
+    assert decrypt(encrypt(data, key), key) == data
+
+
+def test_wrong_key_fails():
+    data = b"secret"
+    token = encrypt(data, Fernet.generate_key().decode())
+    with pytest.raises(Exception):
+        decrypt(token, Fernet.generate_key().decode())