diff --git a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/EncryptionController.java b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/EncryptionController.java
index 9a3965e4..19e1403c 100644
--- a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/EncryptionController.java
+++ b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/EncryptionController.java
@@ -121,10 +121,11 @@ public class EncryptionController {
 		checkEncryptorInstalled(name, profiles);
 		try {
 			String input = stripFormData(data, type, false);
-			Map<String, String> keys = this.helper
-					.getEncryptorKeys(name, profiles, input);
-			String encrypted = this.helper.addPrefix(keys, this.encryptor.locate(keys)
-					.encrypt(input));
+			Map<String, String> keys = this.helper.getEncryptorKeys(name, profiles,
+					input);
+			String textToEncrypt = this.helper.stripPrefix(input);
+			String encrypted = this.helper.addPrefix(keys,
+					this.encryptor.locate(keys).encrypt(textToEncrypt));
 			logger.info("Encrypted data");
 			return encrypted;
 		}
@@ -147,9 +148,11 @@ public class EncryptionController {
 		checkEncryptorInstalled(name, profiles);
 		try {
 			String input = stripFormData(data, type, true);
-			String decrypted = this.helper.stripPrefix(this.encryptor.locate(
-					this.helper.getEncryptorKeys(name, profiles, input)).decrypt(
-							this.helper.stripPrefix(input)));
+			Map<String, String> encryptorKeys = this.helper.getEncryptorKeys(name,
+					profiles, input);
+			TextEncryptor encryptor = this.encryptor.locate(encryptorKeys);
+			String encryptedText = this.helper.stripPrefix(input);
+			String decrypted = encryptor.decrypt(encryptedText);
 			logger.info("Decrypted cipher data");
 			return decrypted;
 		}
diff --git a/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/EncryptionControllerTests.java b/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/EncryptionControllerTests.java
index 1e2f340a..9fe933ff 100644
--- a/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/EncryptionControllerTests.java
+++ b/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/EncryptionControllerTests.java
@@ -15,14 +15,23 @@
  */
 package org.springframework.cloud.config.server.encryption;
 
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.not;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertThat;
 import static org.junit.Assert.assertTrue;
+import static org.mockito.Matchers.anyString;
+import static org.mockito.Mockito.atLeastOnce;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
 import java.util.Map;
 
 import org.junit.Test;
 import org.springframework.cloud.config.server.ConfigServerProperties;
+import org.mockito.ArgumentCaptor;
 import org.springframework.http.MediaType;
 import org.springframework.security.crypto.encrypt.Encryptors;
 import org.springframework.security.crypto.encrypt.TextEncryptor;
@@ -100,6 +109,19 @@ public class EncryptionControllerTests {
 		assertEquals("Wrong decrypted plaintext: " + decrypt, "foo bar", decrypt);
 	}
 
+	@Test
+	public void prefixStrippedBeforeEncrypt() {
+		TextEncryptor encryptor = mock(TextEncryptor.class);
+		when(encryptor.encrypt(anyString())).thenReturn("myEncryptedValue");
+
+		this.controller = new EncryptionController(new SingleTextEncryptorLocator(encryptor), this.properties);
+		this.controller.encrypt("{key:test}foo", MediaType.TEXT_PLAIN);
+
+		ArgumentCaptor<String> captor = ArgumentCaptor.forClass(String.class);
+		verify(encryptor, atLeastOnce()).encrypt(captor.capture());
+		assertThat("Prefix must be stripped prior to encrypt", captor.getValue(), not(containsString("{key:test}")));
+	}
+
 	@Test
 	public void addEnvironment() {
 		TextEncryptorLocator locator = new TextEncryptorLocator() {