diff --git a/src/Orc.SupportPackage.Example/App.xaml.cs b/src/Orc.SupportPackage.Example/App.xaml.cs
index e05ebb9b..23e8ac2b 100644
--- a/src/Orc.SupportPackage.Example/App.xaml.cs
+++ b/src/Orc.SupportPackage.Example/App.xaml.cs
@@ -1,4 +1,4 @@
-namespace Orc.SupportPackage.Example;
+namespace Orc.SupportPackage.Example;
 
 using System.Globalization;
 using System.Windows;
diff --git a/src/Orc.SupportPackage.Example/ViewModels/MainViewModel.cs b/src/Orc.SupportPackage.Example/ViewModels/MainViewModel.cs
index 43248df1..242b547e 100644
--- a/src/Orc.SupportPackage.Example/ViewModels/MainViewModel.cs
+++ b/src/Orc.SupportPackage.Example/ViewModels/MainViewModel.cs
@@ -1,4 +1,4 @@
-namespace Orc.SupportPackage.Example.ViewModels;
+namespace Orc.SupportPackage.Example.ViewModels;
 
 using System;
 using System.Drawing.Imaging;
@@ -24,10 +24,16 @@ public class MainViewModel : ViewModelBase
     private readonly IAppDataService _appDataService;
     private readonly IDirectoryService _directoryService;
     private readonly IFileService _fileService;
+    private readonly IEncryptionService _encryptionService;
+    private readonly ITypeFactory _typeFactory;
+    private readonly IOpenFileService _openFileService;
+    private readonly IMessageService _messageService;
 
     public MainViewModel(IScreenCaptureService screenCaptureService, ISystemInfoService systemInfoService,
         IUIVisualizerService uiVisualizerService, IAppDataService appDataService,
-        IDirectoryService directoryService, IFileService fileService, IServiceProvider serviceProvider)
+        IDirectoryService directoryService, IFileService fileService, IServiceProvider serviceProvider,
+        IEncryptionService encryptionService, ITypeFactory typeFactory, IOpenFileService openFileService,
+        IMessageService messageService)
         : base(serviceProvider)
     {
         _screenCaptureService = screenCaptureService;
@@ -36,12 +42,23 @@ public MainViewModel(IScreenCaptureService screenCaptureService, ISystemInfoServ
         _appDataService = appDataService;
         _directoryService = directoryService;
         _fileService = fileService;
+        _encryptionService = encryptionService;
+        _typeFactory = typeFactory;
+        _openFileService = openFileService;
+        _messageService = messageService;
 
         Screenshot = new TaskCommand(serviceProvider, OnScreenshotExecuteAsync);
         ShowSystemInfo = new TaskCommand(serviceProvider, OnShowSystemInfoExecuteAsync);
         SavePackage = new TaskCommand(serviceProvider, OnSavePackageExecuteAsync);
+        EncryptAndSavePackage = new TaskCommand(serviceProvider, OnEncryptAndSavePackageExecuteAsync);
+        GenerateKeys = new TaskCommand(serviceProvider, OnGenerateKeysExecuteAsync);
+        DecryptPackage = new TaskCommand(serviceProvider, OnDecryptPackageExecuteAsync);
 
         Title = "Orc.SupportPackage example";
+
+        var currentDirectory = Environment.CurrentDirectory;
+        PublicKeyPath = Path.Combine(currentDirectory, "public.pem");
+        PrivateKeyPath = Path.Combine(currentDirectory, "private.pem");
     }
 
     public TaskCommand SavePackage { get; private set; }
@@ -51,6 +68,71 @@ private async Task OnSavePackageExecuteAsync()
         await _uiVisualizerService.ShowDialogAsync<SupportPackageViewModel>();
     }
 
+    public TaskCommand EncryptAndSavePackage { get; private set; }
+
+    private async Task OnEncryptAndSavePackageExecuteAsync()
+    {
+        var supportPackageViewModel = _typeFactory.CreateInstance<SupportPackageViewModel>();
+        supportPackageViewModel.EncryptionContext = new EncryptionContext
+        {
+            PrivateKeyPath = PrivateKeyPath,
+            PublicKey = await _encryptionService.ReadPublicKeyFromPemFileAsync(PublicKeyPath)
+        };
+
+        await _uiVisualizerService.ShowDialogAsync(supportPackageViewModel);
+    }
+
+    public TaskCommand GenerateKeys { get; private set; }
+
+    private async Task OnGenerateKeysExecuteAsync()
+    {
+        _encryptionService.Generate(PrivateKeyPath, PublicKeyPath);
+        await _messageService.ShowInformationAsync("Encryption keys generated");
+    }
+
+    public TaskCommand DecryptPackage { get; private set; }
+
+    private async Task OnDecryptPackageExecuteAsync()
+    {
+        var result = await _openFileService.DetermineFileAsync(new DetermineOpenFileContext
+        {
+        });
+
+        if (!result.Result || result.FileName is null)
+        {
+            return;
+        }
+
+        var directory = Path.GetDirectoryName(result.FileName);
+        var fileName = Path.GetFileNameWithoutExtension(result.FileName);
+
+        if (directory is null)
+        {
+            return;
+        }
+
+        var decryptedPackagePath = Path.Combine(directory, $"{fileName}_dec.spkg");
+
+        using (var sourceStream = _fileService.OpenRead(result.FileName))
+        {
+            if (_fileService.Exists(decryptedPackagePath))
+            {
+                _fileService.Delete(decryptedPackagePath);
+            }
+
+            using (var targetStream = _fileService.Create(decryptedPackagePath))
+            {
+                await _encryptionService.DecryptAsync(sourceStream, targetStream, new EncryptionContext
+                {
+                    PrivateKeyPath = PrivateKeyPath,
+                    PublicKey = await _encryptionService.ReadPublicKeyFromPemFileAsync(PublicKeyPath)
+                });
+            }
+        }
+
+        await _messageService.ShowInformationAsync($"Decrypted support package saved on path {decryptedPackagePath}");
+    }
+
     public TaskCommand Screenshot { get; private set; }
 
     private async Task OnScreenshotExecuteAsync()
@@ -91,4 +173,8 @@ private async Task OnShowSystemInfoExecuteAsync()
     public BitmapImage ScreenPic { get; private set; }
 
     public string SystemInfo { get; set; }
+
+    public string PrivateKeyPath { get; set; }
+
+    public string PublicKeyPath { get; set; }
 }
diff --git a/src/Orc.SupportPackage.Example/Views/MainWindow.xaml b/src/Orc.SupportPackage.Example/Views/MainWindow.xaml
index 3b987da0..7fc90e09 100644
--- a/src/Orc.SupportPackage.Example/Views/MainWindow.xaml
+++ b/src/Orc.SupportPackage.Example/Views/MainWindow.xaml
@@ -55,9 +55,55 @@
 
             <TabItem Header="Zipping all data">
                 <Grid>
+                    <Grid.ColumnDefinitions>
+                        <ColumnDefinition Width="Auto" />
+                        <ColumnDefinition Width="2*" />
+                        <ColumnDefinition Width="Auto" />
+                    </Grid.ColumnDefinitions>
+
+                    <Grid.RowDefinitions>
+                        <RowDefinition Height="Auto" />
+                        <RowDefinition Height="Auto" />
+                        <RowDefinition Height="*" />
+                        <RowDefinition Height="*" />
+                        <RowDefinition Height="*" />
+                    </Grid.RowDefinitions>
+
+                    <Label>Public Key</Label>
+                    <Label Grid.Row="1">Private Key</Label>
+                    <TextBox Grid.Column="1"
+                             Margin="4"
+                             Text="{Binding PublicKeyPath}" />
+                    <TextBox Grid.Column="1"
+                             Margin="4"
+                             Grid.Row="1"
+                             Text="{Binding PrivateKeyPath}" />
+
+                    <Button Grid.RowSpan="2"
+                            Grid.Column="2"
+                            Margin="4"
+                            Padding="6"
+                            Command="{Binding GenerateKeys}">
+                        Generate
+                    </Button>
+
                     <Button Content="Save support package as"
-                            Margin="15  15 15 15"
+                            Margin="15"
+                            Grid.ColumnSpan="3"
+                            Grid.Row="2"
                             Command="{Binding SavePackage}" />
+
+                    <Button Content="Save encrypted support package as"
+                            Margin="15"
+                            Grid.ColumnSpan="3"
+                            Grid.Row="3"
+                            Command="{Binding EncryptAndSavePackage}" />
+
+                    <Button Content="Decrypt support package"
+                            Margin="15"
+                            Grid.ColumnSpan="3"
+                            Grid.Row="4"
+                            Command="{Binding DecryptPackage}" />
                 </Grid>
             </TabItem>
         </TabControl>
diff --git a/src/Orc.SupportPackage.Tests/PublicApiFacts.Orc_SupportPackage_HasNoBreakingChanges_Async.verified.txt b/src/Orc.SupportPackage.Tests/PublicApiFacts.Orc_SupportPackage_HasNoBreakingChanges_Async.verified.txt
index a9d729ec..7830d444 100644
--- a/src/Orc.SupportPackage.Tests/PublicApiFacts.Orc_SupportPackage_HasNoBreakingChanges_Async.verified.txt
+++ b/src/Orc.SupportPackage.Tests/PublicApiFacts.Orc_SupportPackage_HasNoBreakingChanges_Async.verified.txt
@@ -16,6 +16,32 @@ namespace Orc
 }
 namespace Orc.SupportPackage
 {
+    public class EncryptionContext
+    {
+        public EncryptionContext() { }
+        public EncryptionContext(Orc.SupportPackage.EncryptionContext context) { }
+        public EncryptionContext(string publicKey) { }
+        public string PrivateKeyPath { get; set; }
+        public string PublicKey { get; set; }
+    }
+    public class EncryptionService : Orc.SupportPackage.IEncryptionService
+    {
+        public EncryptionService(Orc.FileSystem.IFileService fileService) { }
+        public System.Threading.Tasks.Task DecryptAsync(System.IO.Stream sourceStream, System.IO.Stream targetStream, Orc.SupportPackage.EncryptionContext context) { }
+        public System.Threading.Tasks.Task EncryptAsync(System.IO.Stream sourceStream, System.IO.Stream targetStream, Orc.SupportPackage.EncryptionContext content) { }
+        public void Generate(string secretPath, string publicKeyPath) { }
+        public System.Threading.Tasks.Task<string> ReadPrivateKeyFromPemFileAsync(string keyPath) { }
+        public System.Threading.Tasks.Task<string> ReadPublicKeyFromPemFileAsync(string keyPath) { }
+        protected virtual System.Security.Cryptography.SymmetricAlgorithm CreateAlghorithm() { }
+        protected virtual byte[] GenerateSymmetricKey(int bits) { }
+    }
+    public interface IEncryptionService
+    {
+        System.Threading.Tasks.Task DecryptAsync(System.IO.Stream sourceStream, System.IO.Stream targetStream, Orc.SupportPackage.EncryptionContext content);
+        System.Threading.Tasks.Task EncryptAsync(System.IO.Stream sourceStream, System.IO.Stream targetStream, Orc.SupportPackage.EncryptionContext content);
+        void Generate(string secretLocation, string publicKeyLocation);
+        System.Threading.Tasks.Task<string> ReadPublicKeyFromPemFileAsync(string keyPath);
+    }
     public interface IScreenCaptureService
     {
         System.Drawing.Image CaptureWindowImage(System.Windows.Window window);
@@ -33,6 +59,7 @@ namespace Orc.SupportPackage
     public interface ISupportPackageService
     {
         System.Threading.Tasks.Task<bool> CreateSupportPackageAsync(string zipFileName, string[] directories, string[] excludeFileNamePatterns);
+        System.Threading.Tasks.Task<bool> CreateSupportPackageAsync(string zipFileName, string[] directories, string[] excludeFileNamePatterns, Orc.SupportPackage.EncryptionContext? encryptionContext);
     }
     public class ScreenCaptureService : Orc.SupportPackage.IScreenCaptureService
     {
@@ -54,8 +81,9 @@ namespace Orc.SupportPackage
     }
     public class SupportPackageService : Orc.SupportPackage.ISupportPackageService
     {
-        public SupportPackageService(Microsoft.Extensions.Logging.ILogger<Orc.SupportPackage.SupportPackageService> logger, Orc.SystemInfo.ISystemInfoService systemInfoService, Orc.SupportPackage.IScreenCaptureService screenCaptureService, Orc.FileSystem.IDirectoryService directoryService, Orc.FileSystem.IFileService fileService, Catel.Reflection.IEntryAssemblyResolver entryAssemblyResolver, Catel.Services.IAppDataService appDataService, System.Collections.Generic.IEnumerable<Orc.SupportPackage.ISupportPackageProvider> supportPackageProviders) { }
+        public SupportPackageService(Microsoft.Extensions.Logging.ILogger<Orc.SupportPackage.SupportPackageService> logger, Orc.SystemInfo.ISystemInfoService systemInfoService, Orc.SupportPackage.IScreenCaptureService screenCaptureService, Orc.FileSystem.IDirectoryService directoryService, Orc.FileSystem.IFileService fileService, Catel.Reflection.IEntryAssemblyResolver entryAssemblyResolver, Catel.Services.IAppDataService appDataService, System.Collections.Generic.IEnumerable<Orc.SupportPackage.ISupportPackageProvider> supportPackageProviders, Orc.SupportPackage.IEncryptionService encryptionService) { }
         public virtual System.Threading.Tasks.Task<bool> CreateSupportPackageAsync(string zipFileName, string[] directories, string[] excludeFileNamePatterns) { }
+        public virtual System.Threading.Tasks.Task<bool> CreateSupportPackageAsync(string zipFileName, string[] directories, string[] excludeFileNamePatterns, Orc.SupportPackage.EncryptionContext? encryptionContext) { }
     }
     public static class ZipArchiveExtensions
     {
diff --git a/src/Orc.SupportPackage.Tests/PublicApiFacts.Orc_SupportPackage_Xaml_HasNoBreakingChanges_Async.verified.txt b/src/Orc.SupportPackage.Tests/PublicApiFacts.Orc_SupportPackage_Xaml_HasNoBreakingChanges_Async.verified.txt
index c8b9b4c0..34f994e3 100644
--- a/src/Orc.SupportPackage.Tests/PublicApiFacts.Orc_SupportPackage_Xaml_HasNoBreakingChanges_Async.verified.txt
+++ b/src/Orc.SupportPackage.Tests/PublicApiFacts.Orc_SupportPackage_Xaml_HasNoBreakingChanges_Async.verified.txt
@@ -32,6 +32,7 @@ namespace Orc.SupportPackage
     public interface ISupportPackageBuilderService
     {
         System.Threading.Tasks.Task<bool> CreateSupportPackageAsync(string fileName, System.Collections.Generic.List<Orc.SupportPackage.SupportPackageFileSystemArtifact> artifacts);
+        System.Threading.Tasks.Task<bool> CreateSupportPackageAsync(string fileName, System.Collections.Generic.List<Orc.SupportPackage.SupportPackageFileSystemArtifact> artifacts, Orc.SupportPackage.EncryptionContext? encryptionContext);
     }
     public interface ISupportPackageContentProvider
     {
@@ -41,6 +42,7 @@ namespace Orc.SupportPackage
     {
         public SupportPackageBuilderService(Orc.SupportPackage.ISupportPackageService supportPackageService, Orc.FileSystem.IFileService fileService) { }
         public virtual System.Threading.Tasks.Task<bool> CreateSupportPackageAsync(string fileName, System.Collections.Generic.List<Orc.SupportPackage.SupportPackageFileSystemArtifact> artifacts) { }
+        public virtual System.Threading.Tasks.Task<bool> CreateSupportPackageAsync(string fileName, System.Collections.Generic.List<Orc.SupportPackage.SupportPackageFileSystemArtifact> artifacts, Orc.SupportPackage.EncryptionContext? encryptionContext) { }
     }
     public class SupportPackageDirectory : Orc.SupportPackage.SupportPackageFileSystemArtifact
     {
@@ -70,6 +72,7 @@ namespace Orc.SupportPackage.ViewModels
         public Catel.MVVM.TaskCommand AddFileCommand { get; }
         public Catel.MVVM.TaskCommand CreateSupportPackage { get; }
         public Catel.Collections.FastObservableCollection<string> CustomPaths { get; }
+        public Orc.SupportPackage.EncryptionContext? EncryptionContext { get; set; }
         public bool IncludeCustomPathsInSupportPackage { get; set; }
         public string? LastSupportPackageFileName { get; }
         public Catel.MVVM.Command OpenDirectory { get; }
diff --git a/src/Orc.SupportPackage.Xaml/Services/Interfaces/ISupportPackageBuilderService.cs b/src/Orc.SupportPackage.Xaml/Services/Interfaces/ISupportPackageBuilderService.cs
index 32d32907..5f17d55e 100644
--- a/src/Orc.SupportPackage.Xaml/Services/Interfaces/ISupportPackageBuilderService.cs
+++ b/src/Orc.SupportPackage.Xaml/Services/Interfaces/ISupportPackageBuilderService.cs
@@ -1,4 +1,4 @@
-namespace Orc.SupportPackage;
+namespace Orc.SupportPackage;
 
 using System.Collections.Generic;
 using System.Threading.Tasks;
@@ -6,4 +6,6 @@
 public interface ISupportPackageBuilderService
 {
     Task<bool> CreateSupportPackageAsync(string fileName, List<SupportPackageFileSystemArtifact> artifacts);
+
+    Task<bool> CreateSupportPackageAsync(string fileName, List<SupportPackageFileSystemArtifact> artifacts, EncryptionContext? encryptionContext);
 }
diff --git a/src/Orc.SupportPackage.Xaml/Services/SupportPackageBuilderService.cs b/src/Orc.SupportPackage.Xaml/Services/SupportPackageBuilderService.cs
index 2fbe4419..d59feba3 100644
--- a/src/Orc.SupportPackage.Xaml/Services/SupportPackageBuilderService.cs
+++ b/src/Orc.SupportPackage.Xaml/Services/SupportPackageBuilderService.cs
@@ -1,4 +1,4 @@
-namespace Orc.SupportPackage;
+namespace Orc.SupportPackage;
 
 using System;
 using System.Collections.Generic;
@@ -28,7 +28,12 @@ public SupportPackageBuilderService(ISupportPackageService supportPackageService
         _fileService = fileService;
     }
 
-    public virtual async Task<bool> CreateSupportPackageAsync(string fileName, List<SupportPackageFileSystemArtifact> artifacts)
+    public virtual Task<bool> CreateSupportPackageAsync(string fileName, List<SupportPackageFileSystemArtifact> artifacts)
+    {
+        return CreateSupportPackageAsync(fileName, artifacts, null);
+    }
+
+    public virtual async Task<bool> CreateSupportPackageAsync(string fileName, List<SupportPackageFileSystemArtifact> artifacts, EncryptionContext? encryptionContext)
     {
         Argument.IsNotNullOrWhitespace(() => fileName);
         ArgumentNullException.ThrowIfNull(artifacts);
@@ -66,7 +71,7 @@ public virtual async Task<bool> CreateSupportPackageAsync(string fileName, List<
             builder.AppendLine("- " + directory);
         }
 
-        var result = await _supportPackageService.CreateSupportPackageAsync(fileName, directories, excludeFileNamePatterns);
+        var result = await _supportPackageService.CreateSupportPackageAsync(fileName, directories, excludeFileNamePatterns, encryptionContext);
 
         const string customDataDirectoryName = "CustomData";
         await using var fileStream = new FileStream(fileName, FileMode.OpenOrCreate);
diff --git a/src/Orc.SupportPackage.Xaml/ViewModels/SupportPackageViewModel.cs b/src/Orc.SupportPackage.Xaml/ViewModels/SupportPackageViewModel.cs
index 7b6404d4..52952e67 100644
--- a/src/Orc.SupportPackage.Xaml/ViewModels/SupportPackageViewModel.cs
+++ b/src/Orc.SupportPackage.Xaml/ViewModels/SupportPackageViewModel.cs
@@ -1,4 +1,4 @@
-namespace Orc.SupportPackage.ViewModels;
+namespace Orc.SupportPackage.ViewModels;
 
 using System;
 using System.Collections.Generic;
@@ -89,6 +89,13 @@ public SupportPackageViewModel(ISaveFileService saveFileService, ISupportPackage
 
     public List<string> SelectedCustomPaths { get; }
 
+    /// <summary>
+    /// Optional encryption context. When set, the support package will be encrypted.
+    /// Applications can provide their own <see cref="IEncryptionService"/> implementation
+    /// via dependency injection to customize the encryption algorithm.
+    /// </summary>
+    public EncryptionContext? EncryptionContext { get; set; }
+
     public TaskCommand AddDirectoryCommand { get; set; }
 
     private async Task OnAddDirectoryExecuteAsync()
@@ -210,7 +217,7 @@ private async Task OnCreateSupportPackageExecuteAsync()
                        _isCreatingSupportPackage = false;
                    }))
         {
-            await Task.Run(() => _supportPackageService.CreateSupportPackageAsync(fileName, supportPackageFileSystemArtifacts));
+            await Task.Run(() => _supportPackageService.CreateSupportPackageAsync(fileName, supportPackageFileSystemArtifacts, EncryptionContext));
 
             LastSupportPackageFileName = fileName;
         }
diff --git a/src/Orc.SupportPackage/Context/SupportPackageContext.cs b/src/Orc.SupportPackage/Context/SupportPackageContext.cs
index 3d43e179..67484b28 100644
--- a/src/Orc.SupportPackage/Context/SupportPackageContext.cs
+++ b/src/Orc.SupportPackage/Context/SupportPackageContext.cs
@@ -1,4 +1,4 @@
-namespace Orc.SupportPackage;
+namespace Orc.SupportPackage;
 
 using System;
 using System.IO;
diff --git a/src/Orc.SupportPackage/Cryptography/EncryptionContext.cs b/src/Orc.SupportPackage/Cryptography/EncryptionContext.cs
new file mode 100644
index 00000000..615dc3e1
--- /dev/null
+++ b/src/Orc.SupportPackage/Cryptography/EncryptionContext.cs
@@ -0,0 +1,35 @@
+namespace Orc.SupportPackage
+{
+    using Catel;
+
+    public class EncryptionContext
+    {
+        public EncryptionContext()
+        {
+
+        }
+
+        public EncryptionContext(EncryptionContext context)
+        {
+            Argument.IsNotNull(() => context);
+
+            PublicKey = context.PublicKey;
+            PrivateKeyPath = context.PrivateKeyPath;
+        }
+
+        public EncryptionContext(string publicKey)
+        {
+            PublicKey = publicKey;
+        }
+
+        /// <summary>
+        /// Base64-encrypted xml print of generated public key
+        /// </summary>
+        public string PublicKey { get; set; }
+
+        /// <summary>
+        /// Path to private key on disk
+        /// </summary>
+        public string PrivateKeyPath { get; set; }
+    }
+}
diff --git a/src/Orc.SupportPackage/Cryptography/EncryptionService.cs b/src/Orc.SupportPackage/Cryptography/EncryptionService.cs
new file mode 100644
index 00000000..d37f092d
--- /dev/null
+++ b/src/Orc.SupportPackage/Cryptography/EncryptionService.cs
@@ -0,0 +1,238 @@
+namespace Orc.SupportPackage
+{
+    using System;
+    using System.IO;
+    using System.Security.Cryptography;
+    using System.Text;
+    using System.Threading.Tasks;
+    using Catel;
+    using Catel.Logging;
+    using Orc.FileSystem;
+
+    public class EncryptionService : IEncryptionService
+    {
+        private static readonly ILog Log = LogManager.GetCurrentClassLogger();
+
+        private const int KeySize = 2048;
+        private const int RandomizedKeySize = 256; // For data encryption
+        private const int IVSize = 128;
+
+        private readonly IFileService _fileService;
+
+        private const string PemLeadingPrivate = "-----BEGIN RSA PRIVATE KEY-----";
+        private const string PemTrailingPrivate = "-----END RSA PRIVATE KEY-----";
+        private const string PemLeadingPublic = "-----BEGIN RSA PUBLIC KEY-----";
+        private const string PemTrailingPublic = "-----END RSA PUBLIC KEY-----";
+
+        public EncryptionService(IFileService fileService)
+        {
+            Argument.IsNotNull(() => fileService);
+
+            _fileService = fileService;
+        }
+
+        public async Task EncryptAsync(
+            Stream sourceStream,
+            Stream targetStream,
+            EncryptionContext content)
+        {
+            try
+            {
+                Argument.IsNotNullOrEmpty(() => content.PublicKey);
+
+                using (var rsa = new RSACng(KeySize))
+                {
+                    var publicRaw = Convert.FromBase64String(content.PublicKey);
+
+                    rsa.ImportRSAPublicKey(publicRaw, out _);
+
+                    sourceStream.Seek(0, SeekOrigin.Begin);
+
+                    // To successfuly encrypt with rsa + sha the message (randomized key) should be less than KeySize - SHA overhead size (66 bytes)
+                    // var maxRandomizedKeyLength = rsa.KeySize / 8 - 66
+
+                    using (var symmetric = CreateAlghorithm())
+                    {
+                        // These parameters should be passed as cipher text (encrypted with rsa)
+                        var dataKey = GenerateSymmetricKey(RandomizedKeySize);
+                        var iv = GenerateSymmetricKey(IVSize);
+
+                        symmetric.Key = dataKey;
+                        symmetric.IV = iv;
+
+                        // Create an encryptor to perform the stream transform.
+                        using (var encryptor = symmetric.CreateEncryptor(symmetric.Key, symmetric.IV))
+                        {
+                            var secretBytes = new byte[symmetric.Key.Length + symmetric.IV.Length];
+                            Buffer.BlockCopy(symmetric.IV, 0, secretBytes, 0, symmetric.IV.Length);
+                            Buffer.BlockCopy(symmetric.Key, 0, secretBytes, symmetric.IV.Length, symmetric.Key.Length);
+
+                            var cipherSecret = rsa.Encrypt(secretBytes, RSAEncryptionPadding.OaepSHA256);
+
+                            // Write this block in the beggining of cipher text
+                            await targetStream.WriteAsync(cipherSecret);
+
+                            using (var cryptoStream = new CryptoStream(targetStream, encryptor, CryptoStreamMode.Write, true))
+                            {
+                                await sourceStream.CopyToAsync(cryptoStream);
+                                await cryptoStream.FlushAsync();
+                            }
+                        }
+                    }
+
+
+                    await targetStream.FlushAsync();
+                }
+            }
+            catch (Exception ex)
+            {
+                Log.Error(ex, "Failed to encrypt");
+
+                throw;
+            }
+        }
+
+        public async Task DecryptAsync(
+            Stream sourceStream,
+            Stream targetStream,
+            EncryptionContext context)
+        {
+            try
+            {
+                Argument.IsNotNullOrEmpty(() => context.PrivateKeyPath);
+
+                using (var rsa = new RSACng(KeySize))
+                {
+                    // Read secret keeping only the payload of the key 
+                    var pemText = await ReadPrivateKeyFromPemFileAsync(context.PrivateKeyPath);
+
+                    var secretRaw = Convert.FromBase64String(pemText);
+
+                    rsa.ImportRSAPrivateKey(secretRaw, out _);
+
+                    var ivBytes = IVSize / 8;
+
+                    // Read and decrypt data encryption parameters
+                    var buffer = new byte[256]; // OaepSHA256
+
+                    await sourceStream.ReadAsync(buffer);
+
+                    var ivAndKey = rsa.Decrypt(buffer, RSAEncryptionPadding.OaepSHA256);
+
+                    using (var symmetric = CreateAlghorithm())
+                    {
+                        var iv = ivAndKey[0..ivBytes];
+                        var key = ivAndKey[ivBytes..];
+
+                        // Create an encryptor to perform the stream transform.
+                        using (var decryptor = symmetric.CreateDecryptor(key, iv))
+                        {
+                            using (var cryptoStream = new CryptoStream(sourceStream, decryptor, CryptoStreamMode.Read, true))
+                            {
+                                await cryptoStream.CopyToAsync(targetStream);
+                            }
+                        }
+                    }
+
+                    await targetStream.FlushAsync();
+                }
+            }
+            catch (Exception ex)
+            {
+                Log.Error(ex, "Failed to decrypt");
+                throw;
+            }
+        }
+
+        public void Generate(string secretPath, string publicKeyPath)
+        {
+            using (var rsa = new RSACng(KeySize))
+            {
+                var privateKey = rsa.ExportRSAPrivateKey();
+
+                // Follow DER format specification the result is 270 bytes long (for key size 2048)
+                // It consist of:
+                // 1. collection of the following objects; that takes up 4 bytes
+                // 2. The first object is an integer (which happens to be the public modulus);
+                // the integer itself is 257 bytes (not 256; that's because ASN.1 integers are signed, and so there has to be a leading 00
+                // to make the top bit zero to signify positive), as well as 4 overhead bytes, for a total of 261 bytes
+                // 3. The second object is an integer (which happens to be the public exponent);
+                // if you use 65537 as the exponent, this takes up a total of 5 bytes long (including overhead)
+                // So 4+261+5 gives you a total of 270 bytes
+                var publicKey = rsa.ExportRSAPublicKey();
+
+                var privateKeyPem = Convert.ToBase64String(privateKey);
+                var publicKeyPem = Convert.ToBase64String(publicKey);
+
+                var stringBuilder = new StringBuilder();
+
+                stringBuilder.AppendLine(PemLeadingPrivate);
+                stringBuilder.AppendLine(privateKeyPem);
+                stringBuilder.AppendLine(PemTrailingPrivate);
+
+                var privateTextPem = stringBuilder.ToString();
+
+                stringBuilder.Clear();
+
+                stringBuilder.AppendLine(PemLeadingPublic);
+                stringBuilder.AppendLine(publicKeyPem);
+                stringBuilder.AppendLine(PemTrailingPublic);
+
+                var publicTextPem = stringBuilder.ToString();
+
+                _fileService.WriteAllText(secretPath, privateTextPem);
+                _fileService.WriteAllText(publicKeyPath, publicTextPem);
+            }
+        }
+
+        public async Task<string> ReadPublicKeyFromPemFileAsync(string keyPath)
+        {
+            var pemText = await _fileService.ReadAllTextAsync(keyPath);
+            pemText = pemText.Replace(PemTrailingPublic, "");
+            pemText = pemText.Replace(PemLeadingPublic, "");
+
+            pemText = pemText.Trim('\r', '\n');
+
+            return pemText;
+        }
+
+        public async Task<string> ReadPrivateKeyFromPemFileAsync(string keyPath)
+        {
+            var pemText = await _fileService.ReadAllTextAsync(keyPath);
+            pemText = pemText.Replace(PemTrailingPrivate, "");
+            pemText = pemText.Replace(PemLeadingPrivate, "");
+
+            pemText = pemText.Trim('\r', '\n');
+
+            return pemText;
+        }
+
+        /// <summary>
+        /// Symmetric algorith used in the hybrid crypto
+        /// </summary>
+        /// <returns></returns>
+        protected virtual SymmetricAlgorithm CreateAlghorithm()
+        {
+            var aes = Aes.Create();
+
+            // It is reasonable to set encryption mode to Cipher Block Chaining
+            // (CBC) and Padding PKCS7. Use default options for other symmetric key parameters.
+            aes.Mode = CipherMode.CBC;
+            aes.Padding = PaddingMode.PKCS7;
+            aes.BlockSize = 128;
+
+            return aes;
+        }
+
+        protected virtual byte[] GenerateSymmetricKey(int bits)
+        {
+            using (var random = RandomNumberGenerator.Create())
+            {
+                var key = new byte[bits / 8];
+                random.GetNonZeroBytes(key);
+
+                return key;
+            }
+        }
+    }
+}
diff --git a/src/Orc.SupportPackage/Cryptography/Interfaces/IEncryptionService.cs b/src/Orc.SupportPackage/Cryptography/Interfaces/IEncryptionService.cs
new file mode 100644
index 00000000..1d8bde79
--- /dev/null
+++ b/src/Orc.SupportPackage/Cryptography/Interfaces/IEncryptionService.cs
@@ -0,0 +1,14 @@
+namespace Orc.SupportPackage
+{
+    using System.IO;
+    using System.Threading.Tasks;
+
+    public interface IEncryptionService
+    {
+        Task DecryptAsync(Stream sourceStream, Stream targetStream, EncryptionContext content);
+        Task EncryptAsync(Stream sourceStream, Stream targetStream, EncryptionContext content);
+
+        public void Generate(string secretLocation, string publicKeyLocation);
+        Task<string> ReadPublicKeyFromPemFileAsync(string keyPath);
+    }
+}
diff --git a/src/Orc.SupportPackage/ModuleInitializer.cs b/src/Orc.SupportPackage/ModuleInitializer.cs
index 52ded159..ce7e30a1 100644
--- a/src/Orc.SupportPackage/ModuleInitializer.cs
+++ b/src/Orc.SupportPackage/ModuleInitializer.cs
@@ -1,4 +1,4 @@
-using System.Runtime.CompilerServices;
+using System.Runtime.CompilerServices;
 
 /// <summary>
 /// Used by the ModuleInit. All code inside the Initialize method is ran as soon as the assembly is loaded.
diff --git a/src/Orc.SupportPackage/OrcSupportPackageModule.cs b/src/Orc.SupportPackage/OrcSupportPackageModule.cs
index 9ce3abda..d8de6ba6 100644
--- a/src/Orc.SupportPackage/OrcSupportPackageModule.cs
+++ b/src/Orc.SupportPackage/OrcSupportPackageModule.cs
@@ -15,6 +15,7 @@ public static IServiceCollection AddOrcSupportPackage(this IServiceCollection se
     {
         serviceCollection.TryAddSingleton<ISupportPackageService, SupportPackageService>();
         serviceCollection.TryAddSingleton<IScreenCaptureService, ScreenCaptureService>();
+        serviceCollection.TryAddSingleton<IEncryptionService, EncryptionService>();
 
         serviceCollection.AddSingleton<ILanguageSource>(new LanguageResourceSource("Orc.SupportPackage", "Orc.SupportPackage.Properties", "Resources"));
 
diff --git a/src/Orc.SupportPackage/Services/Interfaces/ISupportPackageService.cs b/src/Orc.SupportPackage/Services/Interfaces/ISupportPackageService.cs
index 6e99d02f..6f275b91 100644
--- a/src/Orc.SupportPackage/Services/Interfaces/ISupportPackageService.cs
+++ b/src/Orc.SupportPackage/Services/Interfaces/ISupportPackageService.cs
@@ -1,8 +1,10 @@
-namespace Orc.SupportPackage;
+namespace Orc.SupportPackage;
 
 using System.Threading.Tasks;
 
 public interface ISupportPackageService
 {
     Task<bool> CreateSupportPackageAsync(string zipFileName, string[] directories, string[] excludeFileNamePatterns);
+
+    Task<bool> CreateSupportPackageAsync(string zipFileName, string[] directories, string[] excludeFileNamePatterns, EncryptionContext? encryptionContext);
 }
diff --git a/src/Orc.SupportPackage/Services/SupportPackageService.cs b/src/Orc.SupportPackage/Services/SupportPackageService.cs
index bcaf4b1b..5c2ec697 100644
--- a/src/Orc.SupportPackage/Services/SupportPackageService.cs
+++ b/src/Orc.SupportPackage/Services/SupportPackageService.cs
@@ -1,4 +1,4 @@
-namespace Orc.SupportPackage;
+namespace Orc.SupportPackage;
 
 using System;
 using System.Collections.Generic;
@@ -30,11 +30,12 @@ public class SupportPackageService : ISupportPackageService
     private readonly IEntryAssemblyResolver _entryAssemblyResolver;
     private readonly IAppDataService _appDataService;
     private readonly IReadOnlyList<ISupportPackageProvider> _supportPackageProviders;
+    private readonly IEncryptionService _encryptionService;
 
     public SupportPackageService(ILogger<SupportPackageService> logger, ISystemInfoService systemInfoService,
         IScreenCaptureService screenCaptureService, IDirectoryService directoryService, IFileService fileService,
-        IEntryAssemblyResolver entryAssemblyResolver, IAppDataService appDataService, 
-        IEnumerable<ISupportPackageProvider> supportPackageProviders)
+        IEntryAssemblyResolver entryAssemblyResolver, IAppDataService appDataService,
+        IEnumerable<ISupportPackageProvider> supportPackageProviders, IEncryptionService encryptionService)
     {
         _logger = logger;
         _systemInfoService = systemInfoService;
@@ -44,10 +45,17 @@ public SupportPackageService(ILogger<SupportPackageService> logger, ISystemInfoS
         _entryAssemblyResolver = entryAssemblyResolver;
         _appDataService = appDataService;
         _supportPackageProviders = supportPackageProviders.ToArray();
+        _encryptionService = encryptionService;
     }
 
     [Time]
-    public virtual async Task<bool> CreateSupportPackageAsync(string zipFileName, string[] directories, string[] excludeFileNamePatterns)
+    public virtual Task<bool> CreateSupportPackageAsync(string zipFileName, string[] directories, string[] excludeFileNamePatterns)
+    {
+        return CreateSupportPackageAsync(zipFileName, directories, excludeFileNamePatterns, null);
+    }
+
+    [Time]
+    public virtual async Task<bool> CreateSupportPackageAsync(string zipFileName, string[] directories, string[] excludeFileNamePatterns, EncryptionContext? encryptionContext)
     {
         Argument.IsNotNullOrEmpty(() => zipFileName);
 
@@ -81,49 +89,23 @@ public virtual async Task<bool> CreateSupportPackageAsync(string zipFileName, st
                     }
                 }
 
-                await using (var fileStream = new FileStream(zipFileName, FileMode.OpenOrCreate))
+                if (encryptionContext is not null)
                 {
-                    using (var zipArchive = new ZipArchive(fileStream, ZipArchiveMode.Update))
+                    using (var memoryStream = new MemoryStream())
                     {
-                        zipArchive.CreateEntryFromDirectory(_appDataService.GetApplicationDataDirectory(Catel.IO.ApplicationDataTarget.UserRoaming), "AppData", CompressionLevel.Optimal);
-                        zipArchive.CreateEntryFromDirectory(supportPackageContext.RootDirectory, string.Empty, CompressionLevel.Optimal);
-
-                        if (directories is not null && directories.Length > 0)
-                        {
-                            foreach (var directory in directories)
-                            {
-                                if (!_directoryService.Exists(directory))
-                                {
-                                    _logger.LogWarning("Directory '{Directory}' does not exist, skipping", directory);
-                                    continue;
-                                }
-
-                                var directoryPathInArchive = directory.TrimEnd('\\').Split('\\').LastOrDefault();
-                                if (!string.IsNullOrEmpty(directoryPathInArchive))
-                                {
-                                    zipArchive.CreateEntryFromDirectory(directory, string.Empty, CompressionLevel.Optimal);
-                                }
-                            }
-                        }
+                        await ZipSupportPackageContentAsync(memoryStream, supportPackageContext, directories, excludeFileNamePatterns);
 
-                        if (excludeFileNamePatterns is not null && excludeFileNamePatterns.Length > 0)
+                        await using (var fileStream = new FileStream(zipFileName, FileMode.OpenOrCreate))
                         {
-                            _logger.LogInformation("Removing excluded files...");
-
-                            var excludeFileNameRegexes = excludeFileNamePatterns.Select(s => new Regex(s.Replace("*", ".*").Replace(".", "\\.") + "$", 
-                                RegexOptions.IgnoreCase | RegexOptions.Compiled, TimeSpan.FromSeconds(1))).ToList();
-
-                            var zipEntries = zipArchive.Entries.ToList();
-                            foreach (var zipEntry in zipEntries)
-                            {
-                                if (excludeFileNameRegexes.Any(regex => regex.IsMatch(zipEntry.FullName)))
-                                {
-                                    zipEntry.Delete();
-                                }
-                            }
+                            await _encryptionService.EncryptAsync(memoryStream, fileStream, encryptionContext);
                         }
-
-                        await fileStream.FlushAsync();
+                    }
+                }
+                else
+                {
+                    await using (var fileStream = new FileStream(zipFileName, FileMode.OpenOrCreate))
+                    {
+                        await ZipSupportPackageContentAsync(fileStream, supportPackageContext, directories, excludeFileNamePatterns);
                     }
                 }
             }
@@ -139,6 +121,52 @@ public virtual async Task<bool> CreateSupportPackageAsync(string zipFileName, st
         return result;
     }
 
+    private async Task ZipSupportPackageContentAsync(Stream stream, SupportPackageContext supportPackageContext, string[] directories, string[] excludeFileNamePatterns)
+    {
+        using (var zipArchive = new ZipArchive(stream, ZipArchiveMode.Update, true))
+        {
+            zipArchive.CreateEntryFromDirectory(_appDataService.GetApplicationDataDirectory(Catel.IO.ApplicationDataTarget.UserRoaming), "AppData", CompressionLevel.Optimal);
+            zipArchive.CreateEntryFromDirectory(supportPackageContext.RootDirectory, string.Empty, CompressionLevel.Optimal);
+
+            if (directories is not null && directories.Length > 0)
+            {
+                foreach (var directory in directories)
+                {
+                    if (!_directoryService.Exists(directory))
+                    {
+                        _logger.LogWarning("Directory '{Directory}' does not exist, skipping", directory);
+                        continue;
+                    }
+
+                    var directoryPathInArchive = directory.TrimEnd('\\').Split('\\').LastOrDefault();
+                    if (!string.IsNullOrEmpty(directoryPathInArchive))
+                    {
+                        zipArchive.CreateEntryFromDirectory(directory, string.Empty, CompressionLevel.Optimal);
+                    }
+                }
+            }
+
+            if (excludeFileNamePatterns is not null && excludeFileNamePatterns.Length > 0)
+            {
+                _logger.LogInformation("Removing excluded files...");
+
+                var excludeFileNameRegexes = excludeFileNamePatterns.Select(s => new Regex(s.Replace("*", ".*").Replace(".", "\\.") + "$",
+                    RegexOptions.IgnoreCase | RegexOptions.Compiled, TimeSpan.FromSeconds(1))).ToList();
+
+                var zipEntries = zipArchive.Entries.ToList();
+                foreach (var zipEntry in zipEntries)
+                {
+                    if (excludeFileNameRegexes.Any(regex => regex.IsMatch(zipEntry.FullName)))
+                    {
+                        zipEntry.Delete();
+                    }
+                }
+            }
+
+            await stream.FlushAsync();
+        }
+    }
+
     private async Task CaptureWindowAndSaveAsync(string screenshotFile)
     {
         Argument.IsNotNullOrEmpty(() => screenshotFile);