[API reference](https://evolu.dev/docs/api-reference) › [@evolu/sqlite-wasm](https://evolu.dev/docs/api-reference/sqlite-wasm) › deriveLegacySqliteKey

```ts
function deriveLegacySqliteKey(
  key: Uint8Array<ArrayBufferLike> &
    Brand<"Entropy"> &
    Brand<"Length32"> &
    Brand<"EncryptionKey">,
  salt: Uint8Array,
): Task<
  Uint8Array<ArrayBufferLike> &
    Brand<"Entropy"> &
    Brand<"Length32"> &
    Brand<"EncryptionKey">,
  never,
  SubtleCryptoDep
>;
```

Defined in: [packages/sqlite-wasm/src/Database.ts:1793](https://github.com/evoluhq/evolu/blob/bc4578a260dd15d5bbf94b83765ca05984d194cb/packages/sqlite-wasm/src/Database.ts#L1793)

Derives the key `@evolu/sqlite-wasm` 2.2.4 used: PBKDF2-HMAC-SHA512 with
256000 iterations and a 32-byte output, over the UTF-8 text `x'` followed by
the key in lowercase hex and `'`, salted with the database's first 16 bytes.

It exists because of a bug in SQLite3 Multiple Ciphers 2.2.4, which 2.2.4
packaged. `x'<hex>'` is SQLCipher's notation for a raw key, which
`@evolu/web` used, but that version took it as a passphrase and derived the
key from the text
(https://github.com/utelle/SQLite3MultipleCiphers/issues/218, fixed in
2.2.5). So the databases it encrypted are keyed with this derivation, and
opening them needs it for as long as they exist, because nothing rekeys
them.

The text is built byte by byte, so no string holds the key, and zeroed once
WebCrypto has imported it.