The first prefix identifies it as having been wrapped by Vault (and is configurable). The “v1” indicates that it’s key version 1, so that when you rotate keys we know which version to use for decryption. The last part is a base64’d concatenation of the IV and ciphertext. Assuming you’re using AES-GCM, after de-base-64ing, the first 96 bits will be the IV, and the rest the ciphertext.
2 Likes