diff --git a/BUCK b/BUCK
index c339d5b..a4c0227 100644
--- a/BUCK
+++ b/BUCK
@@ -1,4 +1,4 @@
-include_defs('//lib/maven.defs')
+include_defs('//bucklets/gerrit_plugin.bucklet')
 
 gerrit_plugin(
   name = 'secure-config',
@@ -16,8 +16,7 @@
   name = 'secure-config_tests',
   srcs = glob(['src/test/java/**/*.java']),
   labels = ['secure-config'],
-  deps = [
+  deps = GERRIT_PLUGIN_API + GERRIT_TESTS + [
     ':secure-config__plugin',
-    '//gerrit-acceptance-framework:lib',
   ],
 )
diff --git a/README.md b/README.md
index 519f1cd..128fcb4 100644
--- a/README.md
+++ b/README.md
@@ -11,12 +11,13 @@
    $ buck build plugins/secure-config
 ```
 
-Resulting plugin jar is generated under /buck-out/gen/plugins/secure-config/secure-config.jar
+Resulting plugin jar is generated under
+/buck-out/gen/plugins/secure-config/secure-config.jar
 
 ## How to install
 
-Differently from the other plugins, secure-config needs to be copied to the /lib directory of
-Gerrit installation.
+Differently from the other plugins, secure-config needs to be copied to the /lib
+directory of Gerrit installation.
 
 Example:
 
@@ -26,9 +27,9 @@
 
 ## How to configure
 
-Add the gerrit.secureStoreClass configuration entry in gerrit.config to instruct Gerrit
-to use the secure-store plugin for the encryption and decryption of all values contained
-in your secure.config file.
+Add the gerrit.secureStoreClass configuration entry in gerrit.config to instruct
+Gerrit to use the secure-store plugin for the encryption and decryption of all
+values contained in your secure.config file.
 
 Example:
 
@@ -39,3 +40,75 @@
    ^D
 ```
 
+## How to run
+
+Gerrit secure.config properties need to be generated and managed using the
+Gerrit init wizard. All the passwords entered at init will be stored as
+encrypted values and then decrypted *on-the-fly* when needed at runtime.
+
+Example:
+
+```
+   $ cd $GERRIT_SITE && java -jar bin/gerrit.war init
+   Using secure store: com.googlesource.gerrit.plugins.secureconfig.SecureConfigStore
+
+   *** Gerrit Code Review 2.13.2-1146-ga89e6a3
+   [...]
+
+
+   $ cat etc/secure.config
+   [auth]
+	registerEmailPrivateKey = hfMC1Yi9NF5N3Yz7cVNUdJNPQfbb2g47RnaPElTraTh0MMB2OE+xeg==
+
+```
+
+## Customising encryption settings
+
+Default settings are fully working but are meant to be use for DEMO purpose
+only. You typicallty need to customize them according to your Company's Policies
+about passwords and confidential data encryption standards.
+
+See below the gerrit.config parameters to customize the encryption security
+settings.
+
+### secureConfig.jceProvider
+
+The JCE cryptographic provider for the encryption algorithms
+and security keys.
+
+Default: SunJCE
+
+### secureConfig.cipher
+
+The encyrption algorithm to be used for encryption. Different JCE providers
+provide a different set of cryptographic algorithms.
+
+Default: PBEWithMD5AndDES.
+
+*NOTE - The default value is considered insecure and should not be used in
+production*
+
+### secureConfig.passwordDevice
+
+The device or file where to retrieve the encryption passphrase.
+
+Default: /dev/zero
+
+*NOTE - The all-zeros password is considered insecure and should not be used in
+production*
+
+### secureConfig.passwordLength
+
+The length in bytes of the password read from the passwordDevice.
+
+Default: 8
+
+*NOTE - A 8-bytes (64-bit) password length is considered insecure and should not
+be used in production*
+
+### secureConfig.encoding
+
+Encoding to use when encrypting/decrypting values from secure.config.
+
+Default: UTF-8
+
diff --git a/src/main/java/com/googlesource/gerrit/plugins/secureconfig/Codec.java b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/Codec.java
new file mode 100644
index 0000000..27868a5
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/Codec.java
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.googlesource.gerrit.plugins.secureconfig;
+
+public interface Codec {
+
+  public abstract String encode(String plain);
+
+  public abstract String decode(String encoded);
+}
diff --git a/src/main/java/com/googlesource/gerrit/plugins/secureconfig/PBECodec.java b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/PBECodec.java
new file mode 100644
index 0000000..9b7c1ba
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/PBECodec.java
@@ -0,0 +1,104 @@
+// Copyright (C) 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.googlesource.gerrit.plugins.secureconfig;
+
+import com.google.inject.Inject;
+import com.google.inject.Singleton;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.security.Key;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.Provider;
+import java.security.Security;
+import java.security.spec.InvalidKeySpecException;
+import java.util.Base64;
+
+import javax.crypto.Cipher;
+import javax.crypto.NoSuchPaddingException;
+import javax.crypto.SecretKeyFactory;
+import javax.crypto.spec.PBEKeySpec;
+import javax.crypto.spec.PBEParameterSpec;
+
+@Singleton
+public class PBECodec implements Codec {
+  private static final Logger log = LoggerFactory.getLogger(PBECodec.class);
+  byte[] salt = new byte[] {0x7d, 0x60, 0x43, 0x5f, 0x02, (byte) 0xe9,
+      (byte) 0xe0, (byte) 0xae};
+  private static final int iterationCount = 2048;
+
+  private final SecureConfigSettings config;
+
+  @Inject
+  public PBECodec(SecureConfigSettings config) {
+    Provider provider = Security.getProvider(config.getJCEProvider());
+    Security.addProvider(provider);
+    this.config = config;
+  }
+
+  @Override
+  public String encode(String s) {
+    try {
+      Key sKey = generateKey();
+      Cipher encoder = getCipher();
+
+      encoder.init(Cipher.ENCRYPT_MODE, sKey, getCipherParameterSpec());
+      return new String(Base64.getEncoder().encodeToString(
+          encoder.doFinal(s.getBytes(config.getEncoding()))));
+
+    } catch (Exception e) {
+      log.error("encode() failed", e);
+      throw new IllegalArgumentException("encode() failed", e);
+    }
+  }
+
+  @Override
+  public String decode(String s) {
+    try {
+      Cipher encoder = getCipher();
+      Key sKey = generateKey();
+
+      encoder.init(Cipher.DECRYPT_MODE, sKey, getCipherParameterSpec());
+      return new String(encoder.doFinal(Base64.getDecoder().decode(s)),
+          config.getEncoding());
+
+    } catch (Exception e) {
+      log.error("decode() failed", e);
+      throw new IllegalArgumentException("encode() failed", e);
+    }
+  }
+
+  private PBEParameterSpec getCipherParameterSpec() {
+    return new PBEParameterSpec(salt, iterationCount);
+  }
+
+  private Cipher getCipher() throws NoSuchAlgorithmException,
+      NoSuchProviderException, NoSuchPaddingException {
+    Cipher encoder =
+        Cipher.getInstance(config.getCipher(), config.getJCEProvider());
+    return encoder;
+  }
+
+  private Key generateKey() throws NoSuchAlgorithmException,
+      NoSuchProviderException, InvalidKeySpecException {
+    PBEKeySpec pbeSpec = new PBEKeySpec(config.getPassword());
+    SecretKeyFactory keyFact =
+        SecretKeyFactory.getInstance(config.getCipher(),
+            config.getJCEProvider());
+    return keyFact.generateSecret(pbeSpec);
+  }
+}
diff --git a/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigSettings.java b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigSettings.java
new file mode 100644
index 0000000..e5f3b3c
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigSettings.java
@@ -0,0 +1,90 @@
+// Copyright (C) 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.googlesource.gerrit.plugins.secureconfig;
+
+import com.google.gerrit.server.config.SitePaths;
+import com.google.inject.Inject;
+import com.google.inject.Singleton;
+
+import org.eclipse.jgit.errors.ConfigInvalidException;
+import org.eclipse.jgit.lib.Config;
+import org.eclipse.jgit.storage.file.FileBasedConfig;
+import org.eclipse.jgit.util.FS;
+
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.Base64;
+
+@Singleton
+public class SecureConfigSettings {
+  private static final String SECURE_CONFIG = "secureConfig";
+  private static final String PASSWORD_DEVICE = "passwordDevice";
+  private static final String PASSWORD_LENGTH = "passwordLength";
+  private static final int DEF_PASSWORD_LENGTH = 8;
+  private static final String CIPHER = "cipher";
+  private static final String ENCODING = "encoding";
+  private static final String DEF_ENCODING = "UTF-8";
+  private static final String JCE_PROVIDER = "jceProvider";
+  private static final String DEF_JCE_PROVIDER = "SunJCE";
+  private final FileBasedConfig gerritConfig;
+  private final char[] password;
+
+  @Inject
+  SecureConfigSettings(SitePaths site) throws IOException,
+      ConfigInvalidException {
+    Config baseConfig = new Config();
+    baseConfig.setString(SECURE_CONFIG, null, CIPHER, "PBEWithMD5AndDES");
+    baseConfig.setString(SECURE_CONFIG, null, PASSWORD_DEVICE, "/dev/zero");
+    baseConfig.setInt(SECURE_CONFIG, null, PASSWORD_LENGTH, DEF_PASSWORD_LENGTH);
+    baseConfig.setString(SECURE_CONFIG, null, ENCODING, DEF_ENCODING);
+    baseConfig.setString(SECURE_CONFIG, null, JCE_PROVIDER, DEF_JCE_PROVIDER);
+
+    gerritConfig =
+        new FileBasedConfig(baseConfig, site.gerrit_config.toFile(),
+            FS.DETECTED);
+    gerritConfig.load();
+    password = readPassword();
+  }
+
+  String getCipher() {
+    return gerritConfig.getString(SECURE_CONFIG, null, CIPHER);
+  }
+
+  public char[] getPassword() {
+    return password;
+  }
+
+  public String getEncoding() {
+    return gerritConfig.getString(SECURE_CONFIG, null, ENCODING);
+  }
+
+  public String getJCEProvider() {
+    return gerritConfig.getString(SECURE_CONFIG, null, JCE_PROVIDER);
+  }
+
+  private char[] readPassword() throws IOException {
+    Path passwordDevice =
+        Paths.get(gerritConfig.getString(SECURE_CONFIG, null, PASSWORD_DEVICE));
+    try (FileInputStream in = new FileInputStream(passwordDevice.toFile())) {
+      byte[] passphrase =
+          new byte[gerritConfig.getInt(SECURE_CONFIG, PASSWORD_LENGTH,
+              DEF_PASSWORD_LENGTH)];
+      in.read(passphrase);
+      return new String(Base64.getEncoder().encode(passphrase)).toCharArray();
+    }
+  }
+}
diff --git a/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigStore.java b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigStore.java
index 3736364..9d657d3 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigStore.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigStore.java
@@ -14,9 +14,10 @@
 
 package com.googlesource.gerrit.plugins.secureconfig;
 
+import com.google.common.collect.FluentIterable;
 import com.google.gerrit.common.FileUtil;
-import com.google.gerrit.server.securestore.SecureStore;
 import com.google.gerrit.server.config.SitePaths;
+import com.google.gerrit.server.securestore.SecureStore;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 
@@ -29,19 +30,23 @@
 import java.io.File;
 import java.io.IOException;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.stream.Collectors;
 
 @Singleton
 public class SecureConfigStore extends SecureStore {
   private final FileBasedConfig sec;
   private final Map<String, FileBasedConfig> pluginSec;
   private final SitePaths site;
+  private final Codec codec;
 
   @Inject
-  SecureConfigStore(SitePaths site) {
+  SecureConfigStore(SitePaths site, PBECodec codec) {
     this.site = site;
+    this.codec = codec;
     sec = new FileBasedConfig(site.secure_config.toFile(), FS.DETECTED);
     try {
       sec.load();
@@ -53,12 +58,14 @@
 
   @Override
   public String[] getList(String section, String subsection, String name) {
-    return sec.getStringList(section, subsection, name);
+    return Arrays.stream(sec.getStringList(section, subsection, name))
+        .map(codec::decode)
+        .toArray(String[]::new);
   }
 
   @Override
-  public synchronized String[] getListForPlugin(String pluginName, String section,
-    String subsection, String name) {
+  public synchronized String[] getListForPlugin(String pluginName,
+      String section, String subsection, String name) {
     FileBasedConfig cfg = null;
     if (pluginSec.containsKey(pluginName)) {
       cfg = pluginSec.get(pluginName);
@@ -75,14 +82,19 @@
         }
       }
     }
-    return cfg != null ? cfg.getStringList(section, subsection, name) : null;
+    return cfg != null ? FluentIterable
+        .from(cfg.getStringList(section, subsection, name))
+        .transform(codec::decode).toArray(String.class) : null;
   }
 
   @Override
   public void setList(String section, String subsection, String name,
       List<String> values) {
     if (values != null) {
-      sec.setStringList(section, subsection, name, values);
+      sec.setStringList(section, subsection, name,
+          values.stream()
+          .map(codec::encode)
+          .collect(Collectors.toList()));
     } else {
       sec.unset(section, subsection, name);
     }
@@ -119,7 +131,7 @@
     }
   }
 
-  private static void saveSecure(final FileBasedConfig sec) throws IOException {
+  private void saveSecure(final FileBasedConfig sec) throws IOException {
     if (FileUtil.modified(sec)) {
       final byte[] out = Constants.encode(sec.toText());
       final File path = sec.getFile();
diff --git a/src/test/java/com/googlesource/gerrit/plugins/secureconfig/CodecTest.java b/src/test/java/com/googlesource/gerrit/plugins/secureconfig/CodecTest.java
new file mode 100644
index 0000000..1b97980
--- /dev/null
+++ b/src/test/java/com/googlesource/gerrit/plugins/secureconfig/CodecTest.java
@@ -0,0 +1,78 @@
+// Copyright (C) 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.googlesource.gerrit.plugins.secureconfig;
+
+import static org.hamcrest.CoreMatchers.equalTo;
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.CoreMatchers.not;
+import static org.junit.Assert.assertThat;
+
+import com.google.gerrit.server.config.SitePaths;
+
+import org.eclipse.jgit.errors.ConfigInvalidException;
+import org.eclipse.jgit.storage.file.FileBasedConfig;
+import org.eclipse.jgit.util.FS;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Paths;
+
+public class CodecTest {
+  static String sitePath;
+  static File gerritConfigFile;
+
+  @BeforeClass
+  public static void setUp() throws IOException {
+    sitePath = "/tmp/" + System.currentTimeMillis();
+    new File(sitePath + "/etc").mkdirs();
+    File gerritConfigFile = new File(sitePath + "/etc/gerrit.config");
+    FileBasedConfig gerritConfig =
+        new FileBasedConfig(gerritConfigFile,
+            FS.DETECTED);
+    gerritConfig.save();
+    gerritConfigFile.deleteOnExit();
+  }
+
+  @Test
+  public void encodedStringShouldBeDifferent() throws Exception {
+    Codec codec = newPBECodec();
+
+    String plainText = "a value";
+    String cipherText = codec.encode(plainText);
+
+    assertThat(cipherText, is(not(plainText)));
+  }
+
+  @Test
+  public void decodedOrEncodedShouldBeTheSameValue() throws Exception {
+    Codec codec = newPBECodec();
+
+    String plainText = "plainText value";
+    String cipherText = codec.encode(plainText);
+    String decodedText = codec.decode(cipherText);
+
+    assertThat(decodedText, is(equalTo(plainText)));
+  }
+
+  private Codec newPBECodec() throws IOException, ConfigInvalidException {
+    SitePaths sitePaths = new SitePaths(Paths.get("/tmp"));
+    SecureConfigSettings config = new SecureConfigSettings(sitePaths);
+    Codec codec = new PBECodec(config);
+    return codec;
+  }
+
+}